Ledger says an unauthorized hardware implant discovered inside a cryptocurrency signer sold through Southeast Asian reseller CryptoBilis could capture users\u2019 recovery phrases and transmit them over a cellular network.<\/p>\n\n\n\n
The company detailed the findings on October 13 after its Donjon security team investigated reports of missing cryptocurrency. Researchers confirmed an implant inside one affected customer\u2019s device on October 10.<\/p>\n\n\n\n
According to Ledger, every fund-loss case it has verified in this investigation involved a signer purchased through CryptoBilis. The reseller has suspended sales while investigators examine the affected devices.<\/p>\n\n\n\n
Ledger said the implant monitored information shown on the signer\u2019s screen during initialization, when users are presented with their 24-word recovery phrase.<\/p>\n\n\n\n
The unauthorized component contained a microcontroller capable of decoding the displayed words. It then transmitted the captured information through an LTE connection using a provisioned eSIM.<\/p>\n\n\n\n
A recovery phrase allows someone to restore access to a cryptocurrency wallet. Capturing those words can therefore expose the wallet\u2019s funds even when the original device continues to function normally.<\/p>\n\n\n\n
Ledger said the implant operated independently of its core security systems. Investigators found no modification to the Secure Element, the Ledger operating system, transactions or digital signatures.<\/p>\n\n\n\n
The findings point to physical tampering designed to capture sensitive information from the display, rather than a confirmed compromise of the chip protecting private keys.<\/p>\n\n\n\n
Ledger began examining customer complaints on October 9 and asked CryptoBilis to stop selling and shipping its products.<\/p>\n\n\n\n
The following day, its security team identified an unauthorized component inside a customer\u2019s signer. CryptoBilis subsequently confirmed that Ledger sales had been suspended.<\/p>\n\n\n\n
Investigators have not established how the implants entered the affected devices or identified who installed them. Ledger has not announced arrests, criminal charges or a completed investigation.<\/p>\n\n\n\n
The company also said it had not verified a fund-loss case involving a signer purchased through another distribution channel. However, researchers continue to review reports involving other devices and locations.<\/p>\n\n\n\n
That distinction leaves the wider scope of the incident unresolved.<\/p>\n\n\n\n
Blockchain analytics firm Bitquery estimated that suspected thefts connected to the investigation totaled approximately $102 million across 324 wallets in its October 12 analysis.<\/p>\n\n\n\n
The firm examined transactions involving Bitcoin, Ethereum and other networks to identify possible links between affected addresses.<\/p>\n\n\n\n
Ledger has not confirmed those figures. It said the total number of affected users and the overall value lost remain unknown.<\/p>\n\n\n\n
The estimate also does not establish that every suspicious transaction identified by researchers resulted from the hardware implant. Further investigation is needed to connect individual losses to the modified devices.<\/p>\n\n\n\n
Ledger advised customers who purchased a signer through CryptoBilis but have not initialized it to leave it unused and contact official Ledger Support.<\/p>\n\n\n\n
For customers who have already used affected devices, the company recommended moving funds promptly to a new signer configured with an entirely new recovery phrase.<\/p>\n\n\n\n
It warned against restoring the existing recovery words into another CryptoBilis-purchased device. Reusing a potentially exposed phrase would leave the wallet dependent on credentials an attacker may already possess.<\/p>\n\n\n\n
Customers who lost funds were asked to report their cases through official support channels and contact local law enforcement.<\/p>\n\n\n\n
Ledger also urged users to consult support or the relevant authorities before opening or sending away suspected tampered hardware. The device may contain evidence needed for the investigation.<\/p>\n\n\n\n
Alongside its hardware findings, Ledger reminded customers that it would never request their recovery phrases, call them unexpectedly or send unsolicited direct messages.<\/p>\n\n\n\n
Separate reports have identified fake Ledger websites attempting to steal recovery words. However, no direct connection between those phishing campaigns and the CryptoBilis incident has been established.<\/p>\n\n\n\n
For devices purchased elsewhere, Ledger said inspection guidance was available through its support website. It cautioned that opening a signer could damage it and advised users to ensure their recovery phrase was securely backed up before attempting an inspection.<\/p>\n\n\n\n
Ledger\u2019s Donjon team is continuing to inspect submitted signers and assess whether they contain similar modifications.<\/p>\n\n\n\n
Researchers are focusing on the physical implants and how they captured information from the display. The company said further findings would be released once verified.<\/p>\n\n\n\n