Ledger said its Donjon security team found an unauthorized hardware implant in wallets sold by Southeast Asian reseller CryptoBilis. The company confirmed the implant on October 10th in one affected user's device.
The implant operates by reading the 24-word recovery phrase displayed on the device's screen during setup and transmitting it over LTE using a provisioned eSIM. According to Ledger's analysis, the component sits inside the device's enclosure and does not modify the device's Secure Element, Ledger operating system, or alter transactions or signatures.
Ledger said it has not confirmed the total number of affected users or the value lost. Onchain investigator Specter has traced more than $86 million in suspected thefts across Ethereum, Tron, and Bitcoin linked to the incident. All confirmed losses involve devices sold through CryptoBilis.
CryptoBilis has confirmed it stopped selling Ledger devices while the investigation continues. Ledger is also reviewing reports of implants in other devices and locations, including claims from an X user who said they found two tampered devices purchased from retail stores in Europe, a claim that has not been independently verified.
Ledger advised CryptoBilis buyers who have not set up their devices not to do so and to contact Ledger Support. Those who have already set up their devices should move assets to a new device with a new recovery phrase. Users who lost funds or hold a tampered device should file a report with local law enforcement.
The company reiterated that it will never call users, message them directly, or ask for their recovery phrase. Ledger said the Donjon will continue analyzing devices it receives and share additional information as the investigation progresses.
