Ledger confirmed that Southeast Asian distributor CryptoBilis sold hardware wallets that were implanted with malicious components: capable of stealing mnemonic phrases

According to an official post from Ledger, its security team Ledger Donjon is investigating Ledger signing devices sold by the Southeast Asian distributor CryptoBilis, which have been implanted with unauthorized hardware components. Ledger confirmed this matter on October 10 regarding a device belonging to an affected user. Donjon's analysis shows that the implant is located within the device's casing and can read the screen display content—decoding the 24-word recovery mnemonic during the initial setup and transmitting it externally via LTE through a built-in eSIM; this component does not alter the security chip, system, or transaction signature.

Currently, all confirmed financial losses related to the incident disclosed on October 9 involve devices sold by CryptoBilis. CryptoBilis has stopped selling Ledger devices. The total number of affected users and the amount of losses have not yet been verified, and Ledger is investigating similar implant reports from other distributors and regions.