Ledger confirms devices from its reseller CryptoBilis were subject to hardware implants, with mnemonic phrases exfiltrated via LTE.

Ledger’s security team has released the latest investigation progress into the hardware implant incident, confirming that unauthorized hardware implants were found in some Ledger hardware wallets sold by Southeast Asian dealer CryptoBilis. The implant, located inside the device casing, can read screen display content, intercept the 24-word mnemonic phrase during user initialization, and exfiltrate data via LTE network using a built-in microcontroller paired with an eSIM. This component operates independently, does not modify the Secure Element or Ledger operating system, and does not interfere with transaction signing. As of now, all confirmed losses from the fund theft incident disclosed on October 9 are tied to devices from CryptoBilis’ sales channel; no related cases have been verified from other channels to date. CryptoBilis has suspended sales of Ledger products, and the investigation is ongoing. Ledger noted that the total number of affected users and total loss amounts have not been confirmed, and figures circulating online are unauthenticated by the official. The company advises users who purchased devices from CryptoBilis and have not initialized them to refrain from setting them up; users who have already set up their devices should immediately transfer their assets to a new device and generate a new mnemonic phrase, and must not restore the mnemonic phrase on the affected device. Affected users should contact Ledger’s official support channels and report the incident to local law enforcement. Ledger stresses that products from its official channels and direct sales are unaffected, reminding users to only purchase through authorized channels and to be vigilant against any requests for mnemonic phrases.