A cryptocurrency hack estimated at more than $90 million (£67.6m) was carried out via covert hardware implanted into crypto-wallet devices manufactured by Paris-based Ledger and sold by south-east Asian retailer CryptoBilis, Ledger said.

When the user set up the device and the screen displayed the recovery phrase, a covert chip inserted inside the wallet’s enclosure recognised and decoded the words, then transmitted them via LTE wireless technology using an eSIM, according to Ledger.

The recovery phrase is a master key for a crypto wallet, enabling anyone to recreate the wallet elsewhere and move funds without the need for a physical device.

Spy chip

Ledger’s account was its first technical explanation for the attack that first surfaced on 9 October, when users began reporting cryptocurrency losses.

Experts analysing the transactions have estimated the losses at more than $90m.

Ledger said it has asked retailers in Hong Kong and south-east Asia to stop selling the devices while it investigates, while chief technology officer Charles Guillemet said the company is reviewing its anti-tampering protections.

Wallet vendors OneKey and Trezor said in social media posts that they were also halting or reviewing their relations with some resellers.

Physical attacks

German electronics retailer MediaMarkt Saturn said it had halted sales of Ledger’s devices, following a report of an unauthorised implant by one user in Germany.

CryptoBilis has also stopped selling the devices, Ledger said.

Attacks have ramped up on cryptocurrency holders over the past year, with attackers carrying out hacks on online crypto exchanges as well as targeting crypto-wallet hardware and physically attacking cryptocurrency holders in their homes.