- Ledger has confirmed that a hidden hardware implant in some devices sold through Southeast Asian reseller CryptoBilis captured users' recovery phrases and transmitted them over a mobile network, raising concerns about tampering within hardware wallet distribution channels.
Ledger disclosed the attack after investigating reports of cryptocurrency theft linked to devices purchased through CryptoBilis. The company's October 15 security response said criminals bought genuine devices, installed concealed electronic components and returned them to distribution through resellers in Southeast Asia.
The implant was designed to capture a wallet's 24-word recovery phrase when it appeared on the device screen during setup. It then transmitted the words through an LTE connection using an embedded SIM, potentially allowing attackers to recreate victims' wallets and transfer their assets without possessing the physical devices.
The incident is particularly significant because hardware wallets are designed to keep the private keys controlling cryptocurrency separate from internet-connected computers and phones. However, anyone who obtains a wallet's recovery phrase can potentially restore the wallet elsewhere and gain access to its funds.
The findings do not establish that Ledger's core security technology was breached. The company said its Secure Element, operating system and internal infrastructure were not compromised, describing the incident as a localized distribution-channel attack rather than a systemic supply-chain breach.
Which Ledger Devices Are Affected and How Much Crypto Was Lost?
Ledger has linked confirmed cases to devices sold through CryptoBilis, a reseller operating across Southeast Asia. The company has not established the total number of affected users or confirmed the full value of cryptocurrency stolen.
Blockchain investigators have estimated that the suspected thefts could exceed $86 million, with other tracking estimates placing the potential losses higher. Those figures remain unverified by Ledger, and the company has cautioned against treating third-party estimates as confirmed totals. The precise number of affected wallets and the full connection between reported thefts and tampered devices remain unresolved.
Ledger has also investigated reports involving devices purchased through other retailers. However, reports of suspicious hardware outside the confirmed CryptoBilis cases should not automatically be treated as evidence that those devices were compromised in the same operation.
The incident follows earlier reports that Ledger was investigating crypto losses associated with the reseller. Wealthier Today's initial report on the suspected $86 million crypto theft covered the preliminary estimates and the company's initial response before the implant mechanism was publicly detailed.
Ledger has asked CryptoBilis to suspend sales and shipments while the investigation continues. The company is working with law enforcement and security researchers to trace the stolen funds and identify where the devices were modified.
The investigation also has implications for other hardware wallet manufacturers. Trezor has said it has no evidence that its devices were compromised in the CryptoBilis incident, but it has removed the reseller from its authorized network as a precaution. OneKey has also revoked the reseller's authorization and announced replacement support for eligible devices purchased through CryptoBilis.
The confirmed findings currently point to a specific distribution channel, not a verified compromise of all Ledger products. Buyers should therefore distinguish the documented incident from broader claims circulating online about the safety of every hardware wallet.
What Crypto Investors Should Do to Protect Their Wallets
Ledger's immediate guidance is directed at customers who purchased devices through CryptoBilis. Buyers who have not initialized those devices should not begin setup and should contact official Ledger Support for instructions. Customers who have already used an affected device should consider moving their assets to a new device with a newly generated recovery phrase, following the manufacturer's current guidance.
A new device alone is not enough if the original recovery phrase remains exposed. The replacement wallet must be initialized securely, and its recovery phrase must be generated through the device's trusted setup process rather than supplied by a seller or printed on a card included in the packaging.
Investors should never enter recovery words into a website, messaging app or computer form, or share them with anyone claiming to be from customer support. Anyone who has already disclosed a recovery phrase should treat it as compromised and seek trusted guidance on securing any remaining assets.
Buying directly from a manufacturer or an authorized reseller can reduce exposure to counterfeit and tampered products, but it is not a guarantee against every physical attack. Ledger's own device genuineness guidance explains that authenticity checks may not detect unauthorized physical modifications when the original Secure Element remains intact.
Users should also be cautious of recovery services and unsolicited messages offering compensation or assistance following the incident. Scammers often exploit security alerts by impersonating wallet manufacturers, asking for recovery phrases or directing victims to fraudulent websites.
For investors holding substantial cryptocurrency balances, the episode reinforces the importance of protecting recovery phrases independently of the device itself. Hardware wallets can reduce exposure to many online threats, but physical tampering and compromised backups can undermine that protection.
The next major development will be evidence establishing the full scale of the thefts, the number of compromised devices and how the attackers introduced the implants into the distribution chain. Until Ledger confirms those details, the estimated losses should remain clearly identified as unverified, and customers should rely on official security updates rather than speculation.