Ledger Confirms CryptoBilis Wallets Were Altered to Expose Recovery Phrases

Ledger confirmed that some hardware wallets sold by Southeast Asian distributor CryptoBilis contained unauthorized components that captured users’ recovery phrases and transmitted them over LTE, creating a serious supply-chain security incident.

The implant was placed inside the device casing and could read information displayed on the screen. During initialization, it captured the 24-word recovery phrase and used a built-in microcontroller and eSIM to send the data over an LTE network.

Ledger said the component operated independently and did not alter the device’s Secure Element or operating system. It also did not interfere with transaction signing.

All confirmed losses disclosed Oct. 9 have been linked to devices distributed through CryptoBilis, Ledger said. No affected-user total or overall loss figure has been confirmed.

CryptoBilis has suspended Ledger product sales. Ledger advised customers who bought uninitialized devices through the distributor not to set them up. Customers who already initialized an affected device should move their assets to a new device with a newly generated recovery phrase and should not restore an existing phrase on the compromised device.

Ledger said its official sales channels and direct sales were not affected. The investigation is continuing, and affected customers should contact Ledger support and local law enforcement.