Ledger Confirms Malicious Parts in CryptoBilis Hardware Wallets

Ledger confirmed that hardware wallets sold by Southeast Asian dealer CryptoBilis contained unauthorized components capable of capturing users’ 24-word recovery phrases and transmitting them over LTE.

Ledger’s security team, Ledger Donjon, identified the issue through a device belonging to one affected user on Oct. 10. The implanted component was located inside the device casing and could read information displayed on the screen.

During initial setup, the component could decode the recovery phrase and send it externally through a built-in eSIM connection. The component did not modify the device’s security chip, operating system or transaction-signing process.

All confirmed funds lost in the incident disclosed Oct. 9 were linked to devices sold by CryptoBilis. The dealer has stopped selling Ledger devices. The number of affected users and total losses have not been established.

Ledger is also examining reports of similar implanted components involving other dealers and regions.