TL;DR
- what: Ledger confirmed an unauthorized hardware implant inside a signer sold by authorized reseller CryptoBilis: it captures the 24-word recovery phrase from the screen during setup and sends it out over LTE through a provisioned eSIM.
- impact: Blockchain investigator Specter puts losses above $86 million among Southeast Asian buyers, and Ledger has not yet confirmed the total number of victims or the total value lost.
- fix: Ledger paused sales through CryptoBilis, Shopee Mall and LazMall, asked resellers in seven markets to pull stock, and advises affected buyers to move assets to a new Ledger signer with a new seed.
- who: Anyone who bought a Ledger device in the last 90 days from CryptoBilis or another Southeast Asian or Hong Kong reseller, or from a third-party marketplace seller, plus any organization holding treasury or customer crypto on hardware signers bought outside direct vendor channels.
Hardware wallet maker Ledger has confirmed that at least one device sold by CryptoBilis, an authorized reseller in Indonesia and Malaysia, carried an unauthorized hardware implant built to steal the wallet's recovery phrase. Pseudonymous blockchain investigator Specter puts total losses among Southeast Asian users above $86 million. Ledger has not confirmed a victim count or a dollar figure. It has, however, widened its sales pause to resellers and distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong.
The attack never touches Ledger's Secure Element or firmware. It goes around them. That makes this a physical supply chain compromise in the plainest sense: the device does what it was designed to do, and a second, hidden device watches it.
How the Implant Works
In its October 13 update, Ledger described the implant as a separate component inside the device enclosure. It does not modify the Secure Element or the Ledger operating system, and it does not alter transactions or signatures. Its only job is to read what the screen shows.
- During first-time setup, the signer shows the 24-word recovery phrase on its display, as it is designed to.
- The implant detects those setup screens and its onboard microcontroller decodes the displayed words.
- The decoded seed is sent out over LTE using a provisioned eSIM, so the implant never needs the victim's phone, computer or Wi-Fi.
- Once the operator has the seed, the wallet can be rebuilt on any device and emptied. No malicious transaction ever has to pass through the victim's signer.
This design gets past the controls hardware wallets are built around. On-device transaction review does not help, because the theft happens at setup, not at signing time. Attestation of the Secure Element also comes back clean, because the Secure Element was never touched.
⚠️ Genuine Check does not catch this — Ledger says its Genuine Check verifies hardware integrity but "cannot detect unauthorized physical modifications to the hardware" if the Secure Element remains intact. A device carrying this implant can pass the vendor's own authenticity check. Ledger also warns that opening a signer to inspect it can damage the device, so it tells users to back up the recovery phrase first.
Three Generations, Multiple Channels
Ledger's findings match an earlier report from Tibane Labs, which documented three variants of the implant, each more advanced than the one before. Tibane Labs rates the third generation as the most sophisticated. It did not come from CryptoBilis. The researchers bought it on Amazon Japan from a third-party seller based in China, and the parcel shipped from Malaysia.
Tibane Labs summed up the problem: "a listing on a mainstream marketplace, a seller in one country, a shipment from another, and nothing on the box to tell it apart from a genuine new device."
A third channel turned up in Europe. Ledger said MediaMarkt Saturn paused Ledger sales in its stores after a customer in Germany found an implant. No loss of funds was reported in that case. Ledger's latest statement says the only confirmed drains are still in Southeast Asia, and that it has not verified a drain linked to a device bought anywhere else.
So far the evidence shows the same implant design reaching buyers through an authorized regional reseller, a global marketplace and a major European electronics retailer. Ledger says its investigation is still working to determine who tampered with the devices and where in the distribution chain it happened.
Vendor and Reseller Response
Ledger's actions and guidance so far:
- Paused sales through CryptoBilis (Indonesia and Malaysia), Shopee Mall (Malaysia and the Philippines) and LazMall (the Philippines). Ledger has not said whether every one of these pauses is tied to this incident.
- On October 13, asked resellers and distributors across Southeast Asia and Hong Kong to suspend sales and pull Ledger devices from shelves.
- Told buyers from CryptoBilis in the last 90 days not to set up devices they have not yet initialized, and advised those who already set them up to move assets to a new Ledger signer with a new seed.
- Told resellers to source stock only through authorized channels and never to restock returned products.
- Said it has no indication that its own infrastructure, systems or services were compromised.
CryptoBilis has stopped selling all hardware wallet inventory until the investigation ends. Its customer alert says a wallet should be treated as unsafe if it arrived with a recovery phrase already printed or written on a card, or if anyone other than the owner has seen the phrase. That warning covers a cruder and older pre-seeded wallet scam. The implant here is more dangerous because the owner generates the seed correctly on the device and is still compromised.
Expect recovery scams to follow — Both Ledger and CryptoBilis warn that neither company will call, message or ask for a recovery phrase or PIN, and that offers to recover lost funds are almost always scams. Publicized drains of this size reliably draw follow-on fraud aimed at the same victims.
Why This Matters Beyond Crypto Hobbyists
Many organizations hold digital assets on hardware signers: treasury reserves, exchange cold storage, payment operations and custody desks. Procurement teams often buy these devices like any other peripheral, from whichever reseller or marketplace has stock. This incident shows that a reseller's "authorized" status does not guarantee the device was untouched along the way, and that marketplace listings can carry modified hardware that looks identical in the box.
The wider lesson applies to any trusted hardware. Secure enclaves and firmware attestation protect what sits inside their boundary. They say nothing about extra hardware placed next to that boundary. A display, keyboard or sensor that handles secrets in plaintext is an attack surface that silicon attestation cannot see. Putting a cellular radio inside the case removes the air gap that hardware wallet threat models usually take for granted.
RedEye Assessment
This is a well-resourced operation. It covers three hardware generations, uses provisioned cellular connectivity, and spans distribution in at least Southeast Asia, Japan and Germany. Someone is building, provisioning and repackaging devices at scale and feeding them into both authorized and marketplace channels. Until Ledger names the point of insertion, treat any signer bought outside direct vendor channels during the affected window as unverified, and keep in mind that the vendor's own integrity check cannot clear it. We expect more reseller pauses, a higher confirmed loss figure, and a rise in fake "recovery" outreach to victims over the coming weeks.
Originally published on RedEye Threat Intelligence.
Top comments (0)