Ledger’s security research team, Donjon, has identified an unauthorized hardware implant in Ledger devices sold by the Southeast Asian reseller CryptoBilis. The company confirmed the presence of this implant on October 10th after analyzing a device from one affected user. The malicious component is designed to read the 24-word recovery phrase displayed on the screen during the wallet setup process. Once detected, the implant decodes the words and transmits them over LTE using a provisioned eSIM, allowing attackers to restore the wallet and control its funds.
Ledger stated that the implant operates as a separate component within the device's enclosure and does not modify the Secure Element or the Ledger operating system. It also does not alter transactions or signatures directly. While all confirmed losses are linked to devices purchased through CryptoBilis, independent onchain investigator Specter traced more than $86 million in suspected thefts across Ethereum, Tron, and Bitcoin networks. Ledger has not yet verified these specific figures or the total number of affected users, noting that circulating numbers come from third parties.
CryptoBilis has ceased selling Ledger devices pending the investigation. Ledger is currently reviewing reports of similar implants in other devices and locations, including unverified claims of tampered units bought from European retail stores. The company advised buyers who have not set up their devices to refrain from doing so and to contact support. Users who have already configured their wallets should immediately move assets to a new device with a fresh recovery phrase and avoid entering any existing phrases on potentially compromised hardware.
The discovery of a physical hardware implant capable of exfiltrating data via cellular networks represents a sophisticated supply chain attack that bypasses traditional software-based security measures. By targeting the visual output of the device during the critical setup phase, the attacker exploits the inherent trust users place in the hardware's integrity at the moment of key generation. This incident underscores the vulnerability of distribution channels where end-users cannot easily verify the internal components of sealed devices before use.
For institutional and individual crypto holders, this event highlights the necessity of rigorous vendor due diligence and the risks associated with secondary market purchases. The potential loss of over $86 million, though unverified by Ledger, signals a significant breach of confidence in the hardware wallet ecosystem. Regulatory bodies and industry standards organizations may face increased pressure to mandate stricter anti-tamper mechanisms and transparent supply chain auditing for cryptographic hardware manufacturers.
