Ledger has expanded its response to tampered devices sold through CryptoBilis, asking resellers and distributors across Southeast Asia and Hong Kong to remove Ledger products from sale while investigators examine a hardware implant found inside affected units.
The company’s October 13 update, documented by The Hacker News, says the implant sits inside the enclosure and reads information shown on the device screen. During wallet setup, it can decode the displayed 24-word recovery phrase and transmit the words over LTE using a provisioned eSIM.
Ledger said the component does not modify the Secure Element, operating system, transactions or signatures. That distinction limits the verified mechanism: the attack compromises setup by stealing the recovery phrase, rather than breaking the wallet’s cryptography or Ledger’s signing process.
All confirmed cases were linked to devices sold through CryptoBilis, and Ledger said its internal infrastructure remained unaffected. The company had not confirmed the total number of affected users or the total value lost at the scan cutoff. Third-party loss estimates should not be treated as a reconciled company figure.
Users who initialized a suspect device cannot make the original recovery phrase safe by resetting the same wallet. The defensible response is to move funds to a new wallet created with a fresh recovery phrase on a trusted device, then retire the compromised seed. Anyone handling the incident should also expect recovery scams.
TOKEN RECON ASSESSMENT
This is a supply-chain compromise with a clearly described exfiltration path, not evidence that Ledger’s secure element was cryptographically defeated. The expanded sales pause widens the operational response beyond one retailer. A final incident scope requires serial-number tracing, device forensics, verified victim losses and evidence showing how modified units entered legitimate-looking sales channels.
