Ledger found an unauthorized hardware implant inside a wallet linked to thefts involving CryptoBilis, its Southeast Asian reseller. Its October response says criminals bought genuine devices, added hidden components and returned them to distribution. The discovery concerns physical tampering, not a demonstrated break of Ledger’s security chip.
Later police and manufacturer notices widen the questions around retail distribution. They do not establish that every reported device, victim or theft belongs to one operation.
Ledger hardware implant timeline
All dates are in 2026. This account includes developments through October 30, checked for this November report.
- October 9: Theft investigation begins. Ledger investigates losses involving CryptoBilis customers. Manufacturer account
- October 10: Implant confirmed. Ledger confirms an added component inside one affected customer’s device. Donjon update, mirrored
- October 13: Screen capture explained. Donjon describes recovery words leaving the device over LTE through an eSIM. Technical findings
- October 15: Distribution rules tightened. Ledger announces regional sales suspensions and stricter stock handling. Company response
- October 28: Singapore issues warning. Police report at least two cases since September 10, with about S$3.5 million lost. Police advisory
- October 30: Trezor reports a separate allegation. A suspected Safe 5 implant awaits examination, with no reported customer losses. Trezor notice
How the implant captured recovery words
Ledger’s Donjon findings describe a separate component reading information shown on the screen. During setup, that includes the 24 recovery words. The implant decoded those words and transmitted them through a cellular connection. Ledger says the Secure Element, operating system, transactions and signatures remained unchanged.
An attacker who copies recovery information can recreate access elsewhere. The victim’s device does not need to approve the later theft, and keeping a handwritten backup offline cannot undo an earlier copy made inside the device.
What Genuine Check can miss
Ledger’s published threat model explains that Genuine Check authenticates the Secure Element. It explicitly excludes detecting spying implants when that original element remains intact. Passing the check therefore cannot establish that no extra hardware was added around it.
A genuine chip and an untouched enclosure are different claims. Our Keystone breach report examines another authenticity problem, involving a stolen verification key. Neither incident proves that every hardware wallet is compromised, but both show why an authenticity result needs a documented technical scope.
What changed after the initial discovery
Ledger’s October 15 response says it asked authorized sellers to suspend sales in Southeast Asia and Hong Kong. Returned devices must never be resold, and stock must stay away from public shelves until purchase. Ledger says its inspected warehouse and retail samples were clean. Sampling cannot certify every device already sold.
The Singapore notice describes tampered Ledger wallets bought at local retailers and ongoing investigations. Its local loss figure is not a worldwide total. Trezor’s separate report remains an allegation pending inspection, not proof of the same attackers or mechanism.
The investigation still leaves gaps. Ledger had not established a verified global victim count or total loss in its October 13 update. Reports from people who bought elsewhere were still being investigated. Those limits matter when comparing social media claims with confirmed cases. A sealed box is not proof of an intact device after a distribution attack. Buyers should retain seller details, receipts and packaging so investigators can trace the purchase. Avoid dismantling a suspect wallet before discussing evidence handling with investigators before taking further action.
What CryptoBilis buyers should do
Ledger’s customer guidance tells buyers not to initialize unused CryptoBilis devices. Existing users should move assets to a new device with a new recovery phrase. Restoring the old phrase elsewhere would preserve an attacker’s copied access.
Use official support channels. Never submit recovery words through a website or send them to anyone offering assistance. Preserve the device and purchase records, and coordinate with Ledger or police before shipping or opening potential evidence. Our BTCPay report covers the related problem of replacing compromised secrets, rather than merely replacing equipment.