Ledger confirmed the Ledger wallet implant captures recovery phrases. The company disclosed findings on October 13. Its Donjon security team investigated losses reported on October 9.
Why the Ledger wallet implant matters
The implant sits inside the wallet’s casing. It monitors information shown on the screen. During setup, a Ledger signer displays a 24-word recovery phrase. That phrase restores access to crypto holdings. Therefore, the implant targets that moment.
The implant contains a microcontroller. It reads information displayed during setup. When it detects recovery phrase screens, it decodes the words. Then it transmits them through an LTE connection. Specifically, it uses a provisioned eSIM. Ledger says the component works independently of normal security systems.
Ledger explained the device does not modify the Secure Element. That chip protects private keys. The implant does not alter the Ledger operating system. It also does not change transactions or signatures. Its only job is to capture sensitive setup information.
Ledger has not verified a drain from devices bought elsewhere. “We have not verified a drain linked to a signer bought elsewhere,” Ledger stated. However, its researchers continue reviewing reports from other devices and locations.
CryptoBilis stops sales as Ledger investigates
The investigation began after customers reported missing crypto. Those customers bought devices through CryptoBilis. CryptoBilis is a reseller serving Southeast Asian markets. On October 9, Ledger began examining complaints. It asked the distributor to stop selling and shipping its products.
By October 10, the security team found an unauthorized implant. The device belonged to one affected customer. Consequently, CryptoBilis confirmed it stopped selling Ledger signers. The investigation continues.
Ledger has not established how the components entered the devices. It has not identified who installed them. The company announced no arrests or criminal charges. It also announced no completed enforcement actions.
Meanwhile, Bitquery estimated suspected thefts reached about $102 million. That estimate covered 324 wallets in its October 12 analysis. The firm traced movements involving Bitcoin and Ethereum. It also examined other blockchain networks.
Those figures remain independent estimates. Ledger has not confirmed Bitquery’s loss calculation. It also has not confirmed the number of affected customers. Furthermore, it has not confirmed whether every suspicious transaction came from the implant.
In its October 13 statement, Ledger said: “We have not confirmed the total number of affected users or the total value lost.” It cautioned that online figures came from third parties. Its investigators have not fully verified them.
Ledger urges CryptoBilis customers to move crypto
Ledger issued security instructions for CryptoBilis customers. If a device is unused, do not initialize it. Instead, contact Ledger Support before taking further action.
If a device is already used, transfer crypto promptly. Move funds to a new signer. Initialize that signer with a completely new recovery phrase. Ledger warned users not to import existing recovery words into another CryptoBilis device. The implant can capture phrases shown during setup. Therefore, an exposed phrase remains exposed.
For customers who lost funds, Ledger requested reports through official support channels. It also advised them to contact local law enforcement. Users holding suspected tampered devices should not send hardware to anyone. First, they should consult Ledger Support or authorities.
Ledger said victims should coordinate with law enforcement before opening their signers. The device could be needed for an investigation. Opening hardware without proper handling could affect physical evidence.
Ledger reiterated it will never call customers. It will never send unsolicited direct messages. It will never request recovery phrases. This warning follows reports of fake Ledger websites. However, no direct connection between those phishing campaigns and this hardware incident has been established.
For customers who bought devices elsewhere, Ledger offers inspection guidance on its support website. The company warned that opening a signer can damage it. Therefore, users should back up recovery phrases securely before attempting an inspection.
Ledger Donjon continues examining hardware implants
Ledger’s Donjon research team continues its technical examination. The company said investigators would analyze additional devices as they arrive. It will release further information when it verifies new findings.
The team specializes in hardware and software security research. Its work includes physical attacks against signing devices. Ledger’s documentation describes circuit analysis and component inspection. It also covers testing of security mechanisms that protect private keys.
The investigation focuses on how the unauthorized component captured display information. Ledger’s October 13 findings identify a separate microcontroller. They also identify a cellular communication system. The company confirmed no modification to the Secure Element or signing process.
Ledger requested information from researchers and others with evidence. Relevant findings can go to security@ledger.com. Affected customers should contact Ledger Support.
Ledger said it would continue reviewing reports involving other signer models. It would also review other geographic locations. The company has not announced a completion date. It has not announced a final report date either.
What comes next for the Ledger wallet implant case
The total number of affected users remains unknown. The total value lost also remains unconfirmed. Moreover, the method of entry remains unclear. Therefore, CryptoBilis customers should act carefully. First, do not initialize unused devices. Second, move existing funds to a new seed. Third, contact Ledger Support and law enforcement if needed.