Ledger Confirms Malicious Parts in CryptoBilis Hardware Wallets

Ledger confirmed that hardware wallets sold by Southeast Asian dealer CryptoBilis contained unauthorized components capable of capturing users’ 24-word recovery phrases and transmitting them over LTE. Ledger’s security team, Ledger Donjon, identified the issue through a device belonging to one affected user on Oct. 10. The implanted component was located inside the device casing and could read information displayed on the screen. During initial setup, the component could decode the recovery phrase and send it externally through a built-in eSIM connection. The component did not modify the device’s security chip, operating system or transaction-signing process.

Source: TokenPost