📡 A spy inside the hardware wallet

The whole point of a hardware wallet is keeping your keys off the internet. Someone found that amusing.

Ledger's security team confirmed that devices sold by CryptoBilis — an authorized reseller in Indonesia, Malaysia and the Philippines — contained hidden implants with an embedded SIM and LTE radio. During setup, each implant read the 24-word recovery phrase off the screen and transmitted it over cellular. The security chip was never touched.

Estimated losses: $86–103M. CryptoBilis halted sales; Trezor and OneKey both cut ties with the reseller. Ledger is now looking beyond CryptoBilis — a user named Johannes found similar implants in two devices bought at MediaMarkt stores in Europe, CoinDesk reports.

Ledger has sold over 8 million wallets. How many passed through the wrong hands is the question that now matters most.

Cointelegraph