Ledger has given its first public account of how a covert component inside devices sold by CryptoBilis could lift users' master keys without touching Ledger's own software. The component, described as a spy chip embedded in CryptoBilis Ledger devices, transmitted wallet keys over a mobile network. The disclosure draws a line between Ledger's code and the third-party hardware, a distinction that matters for anyone who bought a device through CryptoBilis rather than directly from Ledger.
What the spy chip did
The chip sat inside CryptoBilis-branded Ledger devices and relayed wallet keys out over a mobile connection. No changes to Ledger's firmware or apps were needed for the theft to work. That's the part Ledger is stressing: the master keys left the device through a hardware path the company says it didn't build or ship.
Ledger hasn't said how many devices carried the chip, when the affected units were sold, or which mobile networks were used to move the keys. CryptoBilis hasn't issued a public response.
Why it took a hardware route
Hardware wallets are built on the premise that keys never leave the secure element. A chip that can read them and phone home breaks that promise at the physical layer, where software audits don't reach. Ledger's account, thin as it is, points at the supply chain rather than the codebase — the same gap that has worried security researchers about resold and refurbished devices for years.
Who's exposed
The exposure is limited to people who bought a Ledger device through CryptoBilis. Devices bought directly from Ledger or from other authorized sellers aren't implicated by this account. Ledger hasn't said whether it will replace affected units or how users can check whether their device carries the chip, and that silence is the practical problem right now: a key that has already been transmitted can't be un-transmitted.
Anyone who suspects their device came through CryptoBilis should treat the seed phrase as compromised and move funds to a freshly generated wallet — the standard remedy when a key may have left the device.
The unanswered questions
Ledger's statement doesn't name a culprit, a timeframe, or a fix. It also doesn't say whether the spy chip was inserted at a factory, in transit, or somewhere further down the reseller chain. Each possibility points at a different party and a different remedy. Until Ledger or CryptoBilis fills in those blanks, the useful move for holders is the boring one: assume the worst about any device that didn't come straight from the source, and rotate keys.
