Ledger, a cryptocurrency hardware wallet manufacturer based in Paris, disclosed on Tuesday that a batch of its devices sold by Southeast Asian distributor CryptoBilis had been fitted with hidden hardware implants capable of capturing users' recovery phrases and enabling theft of their digital assets.
Through posts on social media, Ledger's security team revealed that the compromised devices contained implants programmed to intercept data shown on device screens. During the initial setup process, these implants identified the 24-word recovery phrase and sent it wirelessly via an embedded eSIM connection using LTE technology. Attackers then leveraged this phrase to gain access to and drain the affected accounts.
The theft occurred on October 9, with funds being withdrawn from multiple accounts. Ledger stated it has not yet determined the full extent of financial losses and cautioned against premature speculation about the scale of the breach.
If you bought a Ledger signer from CryptoBilis and have not set it up, do not set it up and contact Ledger Support. If you have set it up, transfer your assets promptly to a new signer with a new recovery phrase.
Ledger
Do not enter or restore any recovery phrase on a signer bought from CryptoBilis.
Ledger
Ledger indicated that confirmed thefts have predominantly surfaced in Southeast Asia and are linked exclusively to CryptoBilis sales. However, the company noted it is "also reviewing reports of implants in other signers and locations."
CryptoBilis published a statement on its website referencing Ledger's warning, announcing it has "paused all sales and shipments of Ledger devices while Ledger investigates" and pledging to work "cooperating fully with Ledger's investigation."
Although Ledger has not named the specific device models affected, it warned that the implants do not compromise the Secure Element—a critical security component—meaning tampered devices could potentially bypass the company's standard authenticity verification procedures.
Ledger advised CryptoBilis customers to refrain from activating unused devices and instructed current users to immediately move their holdings to a fresh wallet protected by a newly generated recovery phrase. The company recommended that affected parties contact both Ledger and relevant local authorities before handling or transporting the compromised hardware. Ledger stated it believes "the volume of impacted devices is limited."
