Ledger confirms implant hack on CryptoBilis wallets; owners urged to reset recovery phrase

What happened

Ledger says hardware wallets sold through the Southeast Asian reseller CryptoBilis contain unauthorized implants that read the 24‑word recovery phrase displayed on screen and transmit it over an LTE cellular connection. The implant does not alter the wallet’s secure element or operating system, and Ledger’s Genuine Check cannot detect the tampering because the original chip remains intact. The breach has led to confirmed fund losses tied to CryptoBilis‑sold devices, prompting Ledger to warn owners and ask resellers in several Asian markets to halt sales.

Key points

• One confirmed implant in a CryptoBilis‑sold device reads recovery phrases and sends them over LTE.
• The implant does not modify the Secure Element or Ledger’s operating system.
• Ledger’s Genuine Check cannot detect this tampering.
• All verified fund losses are linked to CryptoBilis‑sold wallets in Southeast Asia.
• Other regions (Europe, Singapore, Japan) have reported implants but no verified losses.
• Owners are told not to initialize untouched devices and to move assets to a new device with a fresh recovery phrase.

Ledger's official statements

In an Oct. 13 technical update, Ledger’s Donjon security team described how the implant works: it captures the 24‑word recovery phrase as it appears on screen, decodes the words, and sends them over LTE using an eSIM. The component leaves the Secure Element and Ledger’s operating system unchanged. Ledger said its infrastructure, systems, services and direct sales channel have not been compromised, and that the Genuine Check cannot detect this type of tampering. The company also confirmed that all verified fund losses involve CryptoBilis‑sold devices.

Third‑party reports

European buyer Johannes reported finding implants in two MediaMarkt wallets, but Ledger has not confirmed any losses from those devices. In Singapore, buyer Ben Yorke said a Ledger Flex he purchased from Metapod contained a spy implant, and researcher Mark Karpelès examined the device. A buyer in Japan reported an implant in a Nano X bought from Amazon’s marketplace, and Ledger said the purchase came from a third‑party reseller.

What is confirmed

• Existence of an unauthorized hardware implant that reads recovery phrases and transmits them over LTE.
• The implant does not alter the Secure Element or Ledger’s OS.
• Ledger’s Genuine Check cannot detect this tampering.
• All confirmed fund losses are tied to CryptoBilis‑sold devices in Southeast Asia.
• Ledger’s own infrastructure and direct sales channel have not been compromised.

What is still unclear

• Total number of affected users and total value lost.
• Full distribution path of the implants; which other resellers may be involved.
• Whether any devices sold outside Southeast Asia have been compromised (no verification yet).
• How long the implants have been present in the wild.

Why this matters

The incident shows that a genuine security chip does not guarantee a wallet is free of malicious hardware. Attackers can add a covert module that captures the recovery phrase without changing the verified components. If a recovery phrase is exposed, an attacker can recreate the same private keys on a new device, so owners must generate a new phrase after a compromise. The case also highlights the risk of supply‑chain tampering in retail hardware wallets.

What happens next

Ledger has asked resellers in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales and remove products from shelves. Its Donjon team is analyzing seized devices to trace where the implants entered the supply chain. Owners who suspect tampering are told not to open their devices before contacting Ledger support and, if funds were lost, local law enforcement. Users are advised to follow Ledger’s hardware‑integrity guide and to never share their 24‑word recovery phrase.

Sources

• The Defiant