Ledger Investigates Tampered Devices Sold Through CryptoBilis

Ledger is examining hardware wallets sold through Southeast Asian distributor CryptoBilis after finding an unauthorized hardware implant, a development that has prompted warnings for users to move assets to new devices and recovery phrases.

Ledger CEO Pascal Gauthier said the company’s Donjon security team is inspecting recovered devices, coordinating with law enforcement and contacting affected users. CryptoBilis has stopped selling Ledger products.

The confirmed losses linked to the incident involve Ledger signing devices distributed through CryptoBilis. Ledger identified the implant on Oct. 10 and said it has found no indication that its own infrastructure, systems or services were breached.

Customers who bought a device through the distributor but have not activated it should not do so. Those who already activated one should transfer assets to a new device using a new mnemonic phrase, the 24-word recovery phrase used to restore a wallet.

Ledger also warned that it will not initiate phone calls asking for a recovery phrase. The company’s investigation and user outreach are continuing.