Ledger confirms that hardware wallets sold by Southeast Asian distributor CryptoBilis were implanted with malicious components capable of stealing seed phrases.

PANews October 13 news: According to an official post by Ledger, its security team Ledger Donjon is investigating Ledger signing devices (signers) sold by Southeast Asian distributor CryptoBilis, which were implanted with unauthorized hardware components. Ledger confirmed the matter on October 10 regarding the device of one affected user. Donjon's analysis shows that the implant is located inside the device casing and can read the content displayed on the screen—decoding the 24-word recovery mnemonic during initial setup and exfiltrating it via LTE through a built-in eSIM; the component does not alter the secure chip, the system, or transaction signing. Currently, all confirmed fund losses related to the incident disclosed on October 9 involve devices sold through CryptoBilis. CryptoBilis has stopped selling Ledger devices.

PANews October 13 news: According to an official statement from Ledger, its security team Ledger Donjon is investigating Ledger signing devices sold by Southeast Asian distributor CryptoBilis, which were implanted with unauthorized hardware components. Ledger confirmed the matter on October 10 regarding one affected user's device. Donjon's analysis shows that the implant is located inside the device casing and can read the content displayed on the screen—decoding the 24-word recovery mnemonic during initial setup and exfiltrating it via LTE through a built-in eSIM; the component does not alter the secure chip, the system, or transaction signing. Currently, all confirmed fund losses related to the incident disclosed on October 9 involve devices sold through CryptoBilis. CryptoBilis has stopped selling Ledger devices. The total number of affected users and the amount of losses have not yet been verified, and Ledger is investigating similar implant reports from other distributors and regions.