Ledger says an unauthorized hardware implant discovered inside a cryptocurrency signer sold through Southeast Asian reseller CryptoBilis could capture users’ recovery phrases and transmit them over a cellular network.
The company detailed the findings on October 13 after its Donjon security team investigated reports of missing cryptocurrency. Researchers confirmed an implant inside one affected customer’s device on October 10.
According to Ledger, every fund-loss case it has verified in this investigation involved a signer purchased through CryptoBilis. The reseller has suspended sales while investigators examine the affected devices.
Hidden Component Targeted Recovery Words During Setup
Ledger said the implant monitored information shown on the signer’s screen during initialization, when users are presented with their 24-word recovery phrase.
The unauthorized component contained a microcontroller capable of decoding the displayed words. It then transmitted the captured information through an LTE connection using a provisioned eSIM.
A recovery phrase allows someone to restore access to a cryptocurrency wallet. Capturing those words can therefore expose the wallet’s funds even when the original device continues to function normally.
Ledger said the implant operated independently of its core security systems. Investigators found no modification to the Secure Element, the Ledger operating system, transactions or digital signatures.
The findings point to physical tampering designed to capture sensitive information from the display, rather than a confirmed compromise of the chip protecting private keys.
CryptoBilis Suspends Sales as Investigation Continues
Ledger began examining customer complaints on October 9 and asked CryptoBilis to stop selling and shipping its products.
The following day, its security team identified an unauthorized component inside a customer’s signer. CryptoBilis subsequently confirmed that Ledger sales had been suspended.
Investigators have not established how the implants entered the affected devices or identified who installed them. Ledger has not announced arrests, criminal charges or a completed investigation.
The company also said it had not verified a fund-loss case involving a signer purchased through another distribution channel. However, researchers continue to review reports involving other devices and locations.
That distinction leaves the wider scope of the incident unresolved.
Reported $102 Million Loss Estimate Remains Unconfirmed
Blockchain analytics firm Bitquery estimated that suspected thefts connected to the investigation totaled approximately $102 million across 324 wallets in its October 12 analysis.
The firm examined transactions involving Bitcoin, Ethereum and other networks to identify possible links between affected addresses.
Ledger has not confirmed those figures. It said the total number of affected users and the overall value lost remain unknown.
The estimate also does not establish that every suspicious transaction identified by researchers resulted from the hardware implant. Further investigation is needed to connect individual losses to the modified devices.
Ledger Issues Instructions for CryptoBilis Customers
Ledger advised customers who purchased a signer through CryptoBilis but have not initialized it to leave it unused and contact official Ledger Support.
For customers who have already used affected devices, the company recommended moving funds promptly to a new signer configured with an entirely new recovery phrase.
It warned against restoring the existing recovery words into another CryptoBilis-purchased device. Reusing a potentially exposed phrase would leave the wallet dependent on credentials an attacker may already possess.
Customers who lost funds were asked to report their cases through official support channels and contact local law enforcement.
Ledger also urged users to consult support or the relevant authorities before opening or sending away suspected tampered hardware. The device may contain evidence needed for the investigation.
Customers Warned About Impersonation and Phishing
Alongside its hardware findings, Ledger reminded customers that it would never request their recovery phrases, call them unexpectedly or send unsolicited direct messages.
Separate reports have identified fake Ledger websites attempting to steal recovery words. However, no direct connection between those phishing campaigns and the CryptoBilis incident has been established.
For devices purchased elsewhere, Ledger said inspection guidance was available through its support website. It cautioned that opening a signer could damage it and advised users to ensure their recovery phrase was securely backed up before attempting an inspection.
Donjon Team Examines Additional Devices
Ledger’s Donjon team is continuing to inspect submitted signers and assess whether they contain similar modifications.
Researchers are focusing on the physical implants and how they captured information from the display. The company said further findings would be released once verified.
People with technical evidence about the modifications can contact security@ledger.com, while affected customers should use official Ledger Support.
Ledger has not provided a completion date for the investigation or a timeline for a final report.
