In brief

• Ledger said its Donjon security team found an unauthorized hardware implant in a wallet sold by Southeast Asian reseller CryptoBilis.
• The implant reads the 24-word recovery phrase from the device's screen during setup and transmits it over LTE using a provisioned eSIM.
• Ledger has not confirmed how many users were affected or how much was lost, and is reviewing reports of implants in other devices and locations.

Ledger said its security research team has found an unauthorized hardware implant that captured recovery phrases inside wallets sold by Southeast Asian reseller CryptoBilis, in a tweet on Tuesday.

The Paris-based hardware wallet manufacturer said it confirmed the implant on Saturday in one affected user's device. All confirmed losses from the incident, which Ledger disclosed on Friday, involve devices sold through CryptoBilis, and the company said it has not verified a drain linked to a device bought elsewhere.

Update from Ledger Donjon on the CryptoBilis investigation 🔽@DonjonLedger is investigating Ledger signers sold by CryptoBilis, a reseller in Southeast Asia, that contained an unauthorized hardware implant. Ledger confirmed this on October 10th for one affected user's signer.…

A Ledger device, which the company calls a signer, shows a 24-word recovery phrase during setup. Anyone holding that phrase can restore the wallet and control its funds.

According to the analysis by Ledger Donjon, the company's security team, the implant sits inside the device's enclosure and reads what is shown on the screen. When it detects the recovery phrase screens, its microcontroller decodes the words and transmits them over LTE using a provisioned eSIM.

The implant is a separate component, Ledger said, adding that it does not modify the device's Secure Element or the Ledger operating system, nor does it alter transactions or signatures.

CryptoBilis has confirmed it stopped selling Ledger devices while the investigation continues, according to Ledger.

Ledger said it has not confirmed the total number of affected users or the value lost, and that figures circulating online come from third parties it has not fully verified. Onchain investigator Specter traced more than $86 million in suspected thefts across Ethereum, Tron and Bitcoin, Decrypt reported on Friday.

Ledger reviewing reports beyond CryptoBilis

Ledger said it is also reviewing reports of implants in other signers and locations. An X user has claimed to have found two tampered Ledger devices bought from retail stores in Europe, a claim that has not been independently verified.

The company told CryptoBilis buyers who have not set up their device not to do so and to contact Ledger Support. Those who have should move their assets promptly to a new device with a new recovery phrase, and should not enter or restore any recovery phrase on a device bought from CryptoBilis.

Users who lost funds or hold a tampered device should also file a report with local law enforcement, Ledger said, and should not send the device to anyone, or open it, before speaking to Ledger Support or the police.

Buyers who did not purchase from CryptoBilis can inspect the inside of their device using a Ledger guide, though the company warned that opening a signer can damage it and urged users to back up their recovery phrase first.

Ledger reiterated that it will never call users, message them directly or ask for their recovery phrase. The Donjon will analyze the devices it receives and share more as the investigation continues, the company said.