Ledger warns that tampered devices sold by a Southeast Asian reseller contain implants that steal recovery phrases, urging users to migrate assets immediately.
Key points
- Ledger linked confirmed thefts to devices sold by the Southeast Asian reseller CryptoBilis.
- Hidden hardware implants in these wallets captured 24-word recovery phrases via LTE.
- Users are advised to move assets to new devices with fresh recovery phrases.
Ledger has identified a supply chain attack involving tampered hardware wallets sold by a specific reseller. The company warns that these devices contain hidden implants capable of stealing user credentials.
What happened
Ledger stated on October 11 that all confirmed cases of drained wallets involve devices sold through the Southeast Asia reseller CryptoBilis. On-chain researchers estimated losses at more than $93 million, though Ledger has not confirmed the total figure. The Paris-based maker said its own systems and direct sales channels were not compromised. An unverified claim suggested devices sold via European reseller Mediamarkt might also be affected, but Ledger did not comment on that report. Former Mt. Gox CEO Mark Karpelès posted photos showing a small circuit board hidden under a device’s screen. He said the board included a microcontroller, an antenna, an LTE chip, and an e-SIM card.
The implant monitored the screen to capture the 24-word recovery phrase during setup. It then transmitted the phrase to attackers over LTE. With the phrase, attackers could rebuild the wallet on other devices and drain funds. Karpelès noted the device arrived in intact shrink wrap and passed Ledger’s Genuine Check because the internal security chip was real. The only reliable detection method is opening the device. Ledger urged customers who bought from CryptoBilis to refrain from initializing unused devices.
Why it matters
Hardware wallets protect digital assets by keeping private keys offline. A recovery phrase serves as the master key to rebuild that wallet if the device is lost. If an attacker obtains that phrase, they can access the funds from any device, rendering the hardware protection useless. This incident shows that physical tampering can bypass software security checks. Attackers can hide malicious components inside legitimate-looking products. Users must trust the entire distribution chain, not just the manufacturer. Verifying physical integrity is difficult without specialized tools.
The fix
- Do not initialize any Ledger device purchased from CryptoBilis.
- If you already set up such a device, move your assets to a new wallet with a new recovery phrase.
- Contact Ledger Support through official channels and file complaints with local law enforcement.
- Do not open or ship affected devices before contacting authorities.
Why it matters
Supply chain attacks target the path between manufacturer and user. Physical implants can bypass software-based security features like authenticity checks. Organizations should verify hardware integrity through multiple channels. Users must monitor for unexpected network activity from offline devices. Trusting a single vendor seal is insufficient if distributors are compromised. Teams usually audit distribution partners for security controls. Check whether devices have been opened or modified before deployment.
Background: Supply chain attacks
Verify code signatures and hash values before installing any update. Monitor for unexpected outbound traffic or permission requests. If anomalies appear, isolate the system immediately and revert to a known good state. Treat third-party updates as untrusted until proven otherwise.
Read the full guide: Supply Chain Attack Warning Signs and Response Steps
What to do and how to stay safe: Ledger
- Check your purchase receipt to see if you bought from CryptoBilis.
- Do not enter your recovery phrase into any device sourced from that reseller.
- Monitor your current wallets for unauthorized transactions.
- Wait for official updates before assuming other resellers are safe.
Step-by-step guide: What is password policies and how they protect systems
General security guidance from the Crypt Weekly newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Are all Ledger wallets affected by this implant issue?
Ledger confirmed that all known cases involve devices sold through the Southeast Asian reseller CryptoBilis.
How did the attackers steal the funds?
A hidden hardware implant captured the 24-word recovery phrase and transmitted it via LTE.
Can I tell if my device is tampered with?
The implant is hidden under the screen and the device passes authenticity checks; opening it is the only reliable check.
