Ledger Says Affected User's Device Contained Hardware Implant, CryptoBilis Expands Sales Pause

Hardware implant found in one affected device

Ledger said on Oct. 10 that one affected user's device contained an "unauthorized hardware implant" as part of an investigation into lost funds among Southeast Asian customers who bought from reseller CryptoBilis.

The company shared the update on its verified @Ledger_Support X account. It also said CryptoBilis had confirmed it stopped selling all hardware wallet inventory as a precaution until the investigation concludes. That is broader than Ledger's Oct. 9 request, which only asked that sales and shipments of Ledger devices be paused.

"We have no indication that Ledger's security infrastructure, systems or services have been compromised," the company said.

The update did not identify the device model or explain how the implant worked, leaving its exact role in the reported fund losses unresolved.

What Ledger recommends for buyers

Ledger said customers who bought a Ledger device from CryptoBilis should not begin setup if they have not already done so. Those who have already set up their devices should consider moving assets to a new Ledger device with a new recovery phrase.

A recovery phrase, or seed, is a 24-word code that restores access to a crypto wallet. Ledger warned that reusing the same phrase on a new device would still expose the same private keys and accounts to anyone who knows it.

The company said it was contacting affected users and working with authorities, and credited SEAL 911 with supporting the investigation. It also warned that scammers may try to exploit the incident and directed customers to official support channels. "Ledger will never ask for your 24-word recovery phrase," it said.

Key details

• Ledger found an unauthorized hardware implant in one affected device from reseller CryptoBilis.
• CryptoBilis has now stopped selling all hardware wallet inventory, expanding an earlier pause limited to Ledger devices.
• Ledger says its own security infrastructure has not been compromised.
• The device model and how the implant functioned were not disclosed.
• Ledger advises CryptoBilis buyers who have not set up their devices to avoid doing so, and those who have to move funds to a new device with a new recovery phrase.

What is still unclear

The investigation has not yet explained how the hardware implant worked, which device models may have been affected, or whether other affected users had implants. The scope of the fund losses beyond the reported cases has also not been fully confirmed.

Why this matters

The discovery of a physical hardware implant in a crypto wallet highlights the risk of buying hardware wallets from unauthorized resellers. Physical tampering with a device before it reaches the user can bypass the usual software-based security that hardware wallets rely on.

Sources

• The Defiant

Read also: Ledger Investigates Potential $87M Theft Linked to Crypto Wallet Reseller

Read also: Ledger Confirms Unauthorized Hardware Implant in Compromised Device, Estimated Losses Exceed $86 Million