Key points
- Ledger confirmed that hardware implants in devices sold by CryptoBilis captured user recovery phrases.
- On-chain researchers estimate losses exceed $86 million, with all confirmed cases tied to this reseller.
- The implants used LTE and eSIM technology to transmit data without altering the device's operating system.
The short version
- Ledger identified unauthorized hardware implants in wallets sold through the Southeast Asian reseller CryptoBilis.
- These implants read the screen to capture 24-word recovery phrases and transmitted them via LTE.
- Users who purchased from CryptoBilis are urged to stop using those devices and move assets immediately.
The details
Ledger announced on October 11 that all confirmed cases of wallet draining linked to the October 9 incident involve devices sold through CryptoBilis. The Paris-based company stated that its own systems and direct sales channels were not compromised. On-chain researchers have estimated the total suspected losses at more than $93 million, while other analysts cite figures around $86 million. Ledger has not confirmed the exact number of impacted users or the final stolen amount.
The unauthorized hardware implant was hidden inside the device enclosure, specifically under the screen where padding would normally sit. According to Ledger, the implant sits inside the enclosure and reads data shown on the screen. During the setup process, the signer displays a 24-word recovery phrase. The implant’s microcontroller decodes these words and transmits them to attackers over an LTE connection using a provisioned eSIM card.
Former Mt. Gox CEO Mark Karpelès provided a detailed account after purchasing a tampered Ledger in Malaysia. Photos he posted appeared to show a small circuit board containing a microcontroller, antenna, LTE chip, and eSIM card. He explained that the implant monitors the screen, records the seed phrase, and transmits it. This method allows attackers to rebuild the wallet on any device and empty it without touching the original hardware.
The context
The tampering appears to have occurred along the distribution chain, with someone manually soldering the hardware implant to the device’s circuit boards. Ledger noted that the implant was designed only for information interception and did not modify the device’s operating system, transactions, or signatures. Because the Secure Element chip remains intact, tampered devices can still pass Ledger’s Genuine Check authenticity verification.
Ledger confirmed it is working with relevant authorities and reaching out to impacted users. The company advised customers who bought from CryptoBilis in the last 90 days to refrain from initializing the device if they have not done so. For those who have already set up the device, Ledger recommended moving assets to a new Ledger signer with a new seed phrase.
CryptoBilis stated on its website that it has paused all sales and shipments of Ledger devices while the investigation continues. The reseller said it is cooperating fully with Ledger’s investigation. Ledger also mentioned it is reviewing reports of implants in other signers and locations, though it has not confirmed any cases outside of CryptoBilis sales.
What to watch
Ledger has not yet identified the specific affected models, but warned that tampered devices may pass standard authenticity checks. The company urged victims to contact Ledger Support and local law enforcement before opening or shipping affected devices. It also advised against entering or restoring any recovery phrase on a signer bought from CryptoBilis.
What to do and how to stay safe: Ledger
- Check your purchase history to see if you bought a Ledger device from CryptoBilis in the last 90 days.
- If you have not set up the device, do not initialize it and contact Ledger Support immediately.
- If you have already set up the device, move your assets to a new wallet with a new recovery phrase.
- Report the incident to local law enforcement and Ledger Support before opening or shipping the device.
Step-by-step guide: Secure Home Routers for Small Business Networks
General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did Ledger confirm if devices sold through other resellers are affected?
Ledger stated that all confirmed cases involve devices sold through CryptoBilis, but it is reviewing reports from other locations.
How did the attackers steal the funds?
A hidden hardware implant read the recovery phrase from the screen and transmitted it via LTE to the attackers.
Can the Genuine Check tool detect these tampered devices?
No, because the implant leaves the Secure Element chip intact, allowing tampered devices to pass authenticity checks.
