By Elena Vasquez

Ledger's security team has confirmed an unauthorized hardware implant inside a device sold by Southeast Asian reseller CryptoBilis, the Paris-based manufacturer disclosed on October 13. The implant reads the 24-word recovery phrase from the device's screen during setup and transmits it over LTE through a provisioned eSIM. All confirmed losses involve devices sold through CryptoBilis; Ledger has not verified a drain linked to a device bought elsewhere.

Ledger Donjon, the company's research unit, confirmed the implant on October 10 in one affected user's device, known to the company as a signer. The finding sharpens a supply-chain question the company has not yet answered: how many tampered units reached customers, and through which channels.

How does the implant work?

According to Donjon's analysis, the implant sits inside the device enclosure and monitors the screen. When it detects the recovery-phrase screens displayed during setup, its microcontroller decodes the words and exfiltrates them over a cellular connection using the embedded eSIM.

The component is separate from the wallet's core security architecture. Ledger stated it does not modify the Secure Element or the Ledger operating system, and it does not alter transactions or signatures. The attack targets secret exfiltration rather than key substitution, which is precisely why it evades the device's own protections.

CryptoBilis has stopped selling Ledger devices while the investigation continues, according to the company.

How large are the losses?

Ledger has not confirmed the number of affected users or the value lost, and it cautioned that figures circulating online come from third parties it has not fully verified. Onchain investigator Specter traced more than $86 million in suspected thefts across Ethereum, Tron and Bitcoin, Decrypt reported on Friday.

That figure, roughly equivalent to the annual budget of a mid-sized municipal government, remains attribution rather than audit. Until Ledger or law enforcement confirms the wallet clusters involved, the $86 million should be treated as an upper-bound estimate.

Are devices outside CryptoBilis affected?

Ledger said it is reviewing reports of implants in other signers and locations. An X user has claimed to have found two tampered Ledger devices bought from retail stores in Europe; that claim has not been independently verified. The company has not said whether its distribution audit extends to other authorized resellers, and that omission matters.

For buyers, Ledger's guidance is specific:

• CryptoBilis buyers who have not set up their device should not do so, and should contact Ledger Support.
• Those who have set it up should move assets promptly to a new device with a new recovery phrase.
• Users should not enter or restore any recovery phrase on a CryptoBilis device.
• Victims and holders of tampered devices should file reports with local law enforcement.
• No one should open the device or send it to anyone before speaking with Ledger Support or police.

Buyers who did not purchase from CryptoBilis can inspect the inside of their device using a Ledger guide, though the company warned opening a signer can damage it and urged users to back up their recovery phrase first. Ledger reiterated that it will never call users, message them directly, or ask for a recovery phrase, a warning aimed at scammers who follow breach headlines.

Donjon will analyze devices it receives and share further findings as the investigation continues. Expect the confirmed-loss figure, and the scope of affected distribution channels, to become clearer only as those devices arrive.