Tampered Ledger Wallets Sold Through CryptoBilis Targeted Recovery Phrases

Blockchain tracing puts losses from a tampered Ledger hardware-wallet attack at an estimated $102 million across 324 wallets, though Ledger has not confirmed the total.

The estimate covers transactions across six networks through 2:40 a.m. ET (06:40 UTC) Oct. 15, using prices from Oct. 9.

Ledger said attackers bought genuine devices over several months, added components designed to capture recovery phrases during setup, then returned the wallets to reseller channels in Southeast Asia. Confirmed cases involved devices sold through CryptoBilis. Ledger said its systems and direct sales channels were unaffected.

Ledger advised customers who bought from CryptoBilis in the prior 90 days not to set up unused devices. For devices already set up, Ledger advised customers to transfer their assets to another device and create a fresh recovery phrase.

Hardware wallets keep keys offline, but the reported implants targeted setup, when a recovery phrase is displayed.