In early October, customers in Southeast Asia discovered cryptocurrency missing from Ledger hardware wallets purchased through CryptoBilis, an authorized reseller. Investigation revealed that attackers had intercepted genuine devices in the distribution chain, installing hidden electronics inside the casing before returning them to retailers.
On October 10, Ledger confirmed an unauthorized implant in an affected device. The added circuitry was designed to intercept and capture the 24-word recovery phrase displayed during wallet setup, then transmit it over an embedded LTE connection. The device's protected security chip, operating system, and transaction signatures remained authentic and unaltered.
Blockchain analytics firm Bitquery estimates attackers stole approximately $102 million from 324 wallets across six networks, though Ledger has not confirmed this total or verified that all losses resulted from implanted devices.
How the Attack Exploited Setup Vulnerability
Hardware wallets protect private keys by keeping them offline, separate from internet-connected computers and phones. During initial setup, devices display 24 recovery words that can recreate the wallet and its keys if the device is lost. These words are the only information needed to restore accounts on another device, bypassing the original device's PIN protection.
The CryptoBilis implant targeted this brief setup window. A small controller intercepted signals between the secure chip and display, reconstructed the recovery phrase, and transmitted it via embedded SIM card. Once transmitted, attackers possessed an identical way to access funds while the owner completed setup and used the wallet normally.
Limitations of Device Authentication
Ledger's Genuine Check verifies the authenticity of the device's Secure Element chip but cannot inspect all internal components or prove that nothing has been added to the casing. Ledger's own security documentation acknowledges that physical modifications may escape detection when the original chip remains intact.
Security researchers at Tibane Labs examined modified Ledger Nano X devices fitted with monitoring electronics between the secure chip and display. More sophisticated specimens used custom boards hidden beneath the display, making casual inspection impossible. These specimens were separate from the CryptoBilis case but demonstrated the feasibility of tampering while preserving device authentication.
Distribution Channel as Attack Vector
CryptoBilis operated as an authorized Ledger reseller in Malaysia, Indonesia, and the Philippines. Customers purchasing through authorized sellers followed Ledger's own recommendations. In an October 15 update, Ledger disclosed that attackers had purchased genuine devices over several months, opened them, installed custom components, and returned them to distribution through Southeast Asian resellers.
The company described the incident as an attack on the distribution channel rather than a product defect. Ledger asked authorized resellers and distributors in Southeast Asia and Hong Kong to suspend sales and implemented new controls including restrictions on returned products and keeping devices off display shelves.
Germany's MediaMarktSaturn suspended Ledger sales following a tampered device report. Competitor Trezor reduced its reseller network despite finding no evidence of compromise to its own products.
Recovery Requirements
For affected users, the critical distinction lies between the device itself and the recovery phrase. A PIN protects only the original device from unauthorized use but cannot prevent someone from restoring the same keys on another device elsewhere.
Ledger advised customers who purchased from CryptoBilis not to initialize unused devices, and instructed those already set up to move funds to accounts generated from a fresh recovery phrase on a trusted device. The company recommended using official support channels, preserving relevant evidence, and never providing recovery words to anyone claiming they can assist with recovery.
Moving cryptocurrency to a new wallet with a new recovery phrase generated on a verified, trusted device is necessary to secure funds that may have been compromised during the supply chain attack.
