Today’s Field Note

Ledger has now confirmed the CryptoBilis drain mechanism: a hidden LTE-enabled implant soldered inside the device reads your 24-word recovery phrase straight off the screen during setup, then transmits it over the mobile network. The Secure Element is untouched, so Genuine Check passes clean. Suspected losses run around $86M, and the fallout is spreading beyond CryptoBilis, with MediaMarkt pulling Ledger stock, Karpeles reporting a tampered airport-bought Ledger Flex, and Trezor and OneKey cutting ties with the reseller. Separately, Autheo’s THEO fell 92% on Base after a suspected bridge exploit involving a 19 million-token mint and immediate sell-off. This is a supply-chain and setup-trust problem, not a firmware bug, which means your existing precautions may not cover it.

Today’s Move

  • If you own a Ledger bought from any reseller (CryptoBilis, Metapod, MediaMarkt, airport kiosks, marketplaces), treat the seed as compromised: generate a new wallet on a device bought direct from Ledger and move funds now.
  • Do not rely on Genuine Check alone. It validates the Secure Element, not added implant hardware.
  • Weigh the Ledger Flex and other models bought secondhand or at retail with physical suspicion; inspect for tampering or retire them.
  • Avoid THEO entirely: do not buy, sell, or bridge it on Base until Autheo publishes a post-mortem on the 19M mint.
  • Watch the THEO bridge contract and the minter address for where proceeds move, and blacklist those addresses in any integrations.

Resources

  • https://decrypt.co/380826/ledger-finds-lte-implant-that-stole-recovery-phrases-in-suspected-86m-drain
  • https://thedefiant.io/news/security/karpel-s-says-airport-bought-ledger-flex-contained-spy-implant
  • https://thedefiant.io/news/hacks/autheo-s-theo-plunges-92-after-suspected-bridge-exploit-on-base
  • Incident trackers (reference standard): Rekt leaderboard · SlowMist Hacked

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @ItsAlreadyPrice or subscribe via RSS.