Newsletter
Ledger indicates that its Donjon security team discovered an unauthorized hardware implant component in a wallet sold by a Southeast Asian reseller CryptoBilis.
Ledger It is not yet confirmed how many users have been affected or how much money has been lost, and reports of implanted components in other devices and locations are being reviewed.
Ledger stated that its security research team discovered in a tweet on Tuesday that there was an unauthorized hardware implant component in a wallet sold by CryptoBilis, which would intercept recovery phrases.
The Paris-based hardware wallet manufacturer stated that they confirmed the presence of this embedded component in the device of one affected user on Saturday. In the incident disclosed on Friday, all confirmed losses involved devices sold through CryptoBilis; the company mentioned that they have not yet verified any cases of funds theft related to devices purchased through other channels.
Ledger posted an update on X stating: ' Ledger Donjon is investigating Ledger signer sold by a Southeast Asian reseller CryptoBilis. These devices contain unauthorized hardware implant components. Ledger confirmed this issue for an affected user's signer on October 10...'
The Ledger device, which is also referred to by the company as signer, will display a 24-word recovery phrase during the setup process. Anyone who possesses this phrase can recover their wallet and control the funds within it.
Ledger indicates that this embedded component is a separate unit, and it is also stated that it will not modify the device's Secure Element or Ledger operating system, nor will it alter transactions or signatures.
According to Ledger, during the investigation, CryptoBilis has confirmed that it has stopped selling Ledger devices.
Ledger indicates that the total number of affected users or the amount of losses has not yet been confirmed. The figures circulating online come from third parties, and the company has not fully verified them. Onward investigators on the blockchain, Specter, have traced suspected theft amounts across Ethereum, Tron, and Bitcoin to exceed 86 million US dollars, Decrypt reported on Friday.
Ledger continues to review reports other than CryptoBilis.
Ledger indicates that reports of embedded components are also being reviewed in other signer and other locations. A user named X claims to have found tampering in two Ledger devices purchased from a European retail store, but this claim has not yet been independently verified.
The company advises users who purchased devices from CryptoBilis but have not yet completed the setup to stop setting them up and contact Ledger Support instead. Users who have already completed the setup should transfer their assets to a new device that uses the new recovery phrase as soon as possible, and should not enter or use any recovery phrases on devices purchased from CryptoBilis.
Ledger indicates that if a user has lost funds or is in possession of a tampered device, they should also report the incident to the local law enforcement authorities. Furthermore, before contacting Ledger Support or the police, the user should not send the device to anyone else, nor should they attempt to disassemble it.
For buyers who did not purchase their devices from CryptoBilis, Ledger claims that their guides can be used to inspect the interior of the devices. However, the company warns that opening signer may damage the devices and urges users to back up their recovery phrases first.
Ledger reiterates that the company will never call users, send messages directly to them, or request recovery phrases. The company states that Donjon will analyze the devices received and share more information as the investigation continues.
