Ledger's security team, Donjon, identified an unauthorized hardware implant in devices sold by the Southeast Asian reseller CryptoBilis. The company confirmed the presence of this component in one user's device on October 10. The implant is a separate hardware piece placed inside the device enclosure that reads recovery phrases displayed on the screen.
The malicious component uses a microcontroller to decode the 24-word recovery phrase and transmits the data via LTE using a provisioned eSIM. Ledger stated that the implant does not alter the device's Secure Element, operating system, or transaction signatures. CryptoBilis has suspended sales of Ledger products pending the investigation.
While third-party reports estimate losses at over $86 million across Ethereum, Tron, and Bitcoin, Ledger has not independently verified these figures or the total number of affected users. The company is currently reviewing claims regarding tampered devices in other locations, including reports from Europe.
Ledger advises customers who purchased devices from CryptoBilis not to set them up and to contact support immediately. Users who have already configured such devices are urged to transfer their assets to a new wallet with a fresh recovery phrase. The company also recommends reporting incidents to local law enforcement.
