Ledger is reassessing its reseller oversight and hardware security procedures after discovering that modified crypto wallets sold by Southeast Asian reseller CryptoBilis contained hidden components capable of stealing users’ recovery phrases.
In a Tuesday post on X, the company explained that the unauthorized hardware was concealed inside the wallet casing. When a user set up the device and viewed their 24-word recovery phrase on its screen, a microcontroller inside the implant could recognize the words and send them to an attacker through an LTE connection using an embedded SIM.
The recovery phrase provides complete access to a cryptocurrency wallet. With those 24 words, an attacker can restore the wallet on another device and transfer its assets without possessing the original signer or changing any transactions on the compromised device.
Ledger’s latest findings provide the first public account of how the CryptoBilis-related thefts were carried out. The company said the implant left the Secure Element, which protects private keys, untouched. It also did not modify the operating system, transaction data or digital signatures. Ledger characterized the incident as a physical supply-chain compromise, rather than a breach of its software or internal systems.
Ledger Chief Technology Officer Charles Guillemet said the company was reviewing its reseller policies and anti-tampering defenses. He also encouraged researchers and hardware vendors to work together on stronger methods for detecting unauthorized modifications and verifying device custody throughout distribution.
CEO Pascal Gauthier said the review would cover both Ledger’s direct sales channels and its reseller network. The investigation is still underway as the company seeks to establish who installed the malicious components and at what stage of the supply chain the devices were altered.
In a separate report, former Mt. Gox CEO Mark Karpeles claimed he discovered a spy implant inside a Ledger Flex wallet he purchased at Singapore Airport.
Ledger confirmed that at least one affected signing device contained unauthorized hardware. According to the company, every confirmed loss associated with the October 9 incident involved a signer sold through CryptoBilis. It has not verified thefts involving devices purchased from other sellers, but is examining reports of potentially compromised wallets in additional locations.
The company has yet to disclose a confirmed victim count or the total value of stolen funds. Blockchain researchers have estimated that more than 300 wallets may have lost as much as $93.2 million. Tether has also frozen $10 million in USDT connected to the thefts.
CryptoBilis has stopped selling Ledger devices. Ledger advised customers who purchased signers from the reseller not to initialize them. Anyone who has already used an affected device should transfer their cryptocurrency to a new device and generate a fresh recovery phrase to secure their funds.
