Ledger confirmed that hardware implants were found in devices sold by the Southeast Asian reseller CryptoBilis. The unauthorized components sit inside the device casing and use a microcontroller to decode the 24-word recovery phrase displayed during setup. The stolen data is then transmitted to attackers via an LTE connection using a provisioned eSIM.
The implants do not modify the Secure Element or the operating system, nor do they affect transaction signatures. Ledger stated that its own infrastructure remains secure. CryptoBilis has suspended sales and closed its physical stores while the investigation continues. Other manufacturers, including Trezor and OneKey, have removed the reseller from their partner networks.
Reports of similar implants have emerged regarding devices purchased at European MediaMarkt stores and an airport in Singapore. MediaMarktSaturn has removed Ledger products from its retail and online platforms. Ledger has not verified the total number of affected users or the total financial losses, noting that third-party estimates circulating online are unconfirmed.
Ledger advises users who purchased devices from CryptoBilis not to set them up. Those who have already configured such devices should immediately transfer their assets to a new wallet with a fresh recovery phrase. The company urges affected users to contact its support team and report the incidents to local law enforcement before attempting to open or send the hardware for inspection.
