Ledger Links Verified Wallet Theft Cases to CryptoBilis Devices

Ledger has linked verified theft cases involving its hardware wallets to devices sold by CryptoBilis, a Southeast Asian reseller, after an examined unit was found to contain an unauthorized hardware implant.

Former Mt. Gox CEO Mark Karpelès found a module wired into the screen’s data connection, along with LTE/eSIM hardware and an antenna. The setup may have captured recovery words when they appeared on the display and transmitted them over cellular networks. Ledger’s genuine-device check can verify the security element, but it cannot rule out physical tampering around the screen.

Ledger’s verified cases involved devices sold by CryptoBilis, which has suspended hardware-wallet sales and shipments. Ledger advises people who bought a device from the reseller in the past 90 days and initialized it to move assets to a new device using a new recovery phrase. Buyers whose devices have not been initialized should not set them up.

The incident highlights a supply-chain risk for self-custody: a device can pass a digital authenticity check while still having a physical modification. Ledger warns users to watch for impersonators and never share recovery phrases with them.