- Ledger confirms hardware implants in CryptoBilis wallets exposed 24-word seed phrases.
- Reported crypto losses exceed $86M, but Ledger has yet to verify the total.
- Ledger urges CryptoBilis customers to move funds to new, secure hardware wallets.
Ledger has revealed how an unauthorized hardware implant inside crypto wallets sold by Southeast Asian reseller CryptoBilis could capture users’ 24-word recovery phrases and transmit them over cellular networks.
The October 13 findings follow reports of stolen cryptocurrency disclosed on October 9, leaving affected customers facing losses as investigators examine the breached devices. Ledger has confirmed an implant in one customer’s signer but has not disclosed how many users were affected.
Ledger Investigation Reveals How the Hardware Implant Worked
According to Ledger’s Donjon security team report, the component sits inside the device enclosure and monitors information displayed on its screen. When the recovery phrase appears during initial setup, a microcontroller detects the relevant screens, decodes the 24 words, and transmits them through an LTE connection using a provisioned eSIM.
The component operates separately from the wallet’s existing security systems. Ledger said it does not change the Secure Element, modify the operating system, or interfere with transactions and signatures.
The investigation, therefore, centers on information collected from the display rather than changes to the device’s transaction processing. Ledger first confirmed an unauthorized implant in an affected customer’s signer on October 10, following reports of missing funds.
Reported Crypto Losses Exceed $86 Million
Ledger has confirmed that all fund losses linked to the incident involved signers purchased through CryptoBilis. The company said it has not verified any related drain involving a device bought elsewhere, although it is reviewing reports of implants in other devices and locations.
Blockchain investigator Specter estimated losses exceeding $86 million. However, Ledger cautioned that figures circulating from outside investigators remain unverified and said it cannot confirm the number of victims or the value of assets stolen.
Ledger Advises Affected Users to Replace Devices
Ledger instructed customers who purchased a CryptoBilis signer but have not initialized it to avoid setup and contact support. Those who already initialized one were advised to move their cryptocurrency to a new signer using a newly generated recovery phrase.
The company also warned customers not to restore existing recovery phrases on CryptoBilis-purchased devices or to enter them on websites, in applications, or on forms. In addition, customers who reported stolen funds were asked to contact Ledger Support and local law enforcement before opening or shipping any potentially tampered hardware.
Related: Ledger Confirms Hardware Implant in CryptoBilis Wallet, Issues Urgent Warning
Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.
