Ledger’s October 13 update on unauthorized hardware implants identified only the Southeast Asian reseller CryptoBilis as the source of compromised devices. The company’s security team, Ledger Donjon, confirmed that these implants capture recovery phrases during setup and transmit them via cellular connection. Ledger officially acknowledged the issue on October 10 following reports from an affected user.
Users have challenged the company’s findings, reporting similar tampered devices appearing at the European electronics chain MediaMarkt. One user provided video evidence of a device purchased at a MediaMarkt store containing unauthorized cables and a cellular module. The stock was reportedly traced to the European distributor Aqipa, and the device has been sent to Ledger for further analysis.
Ledger has not yet confirmed any cases outside of the CryptoBilis reseller or addressed potential reimbursements for affected users. One trader reported a loss of $6.6 million in Bitcoin after purchasing a device from the reseller. The company’s Genuine Check feature verifies the security chip but does not detect all additional hardware components, meaning modified devices may still pass the test.
The company advises users to contact support and file police reports regarding drained accounts. Ledger recommends that customers who purchased devices from CryptoBilis immediately transfer their funds to a new wallet with a fresh recovery phrase. Ledger continues to investigate reports of implants in other locations but has not issued a product recall at this time.
