Ledger Warns Some Crypto Wallets Sold by a Southeast Asian Reseller Contained Hidden Spy Hardware

Cryptocurrency wallet maker Ledger has warned that devices sold through Southeast Asian reseller CryptoBilis contained hidden hardware implants. According to the company's security research team, the implants read data shown on the device screen. During setup, they picked up the user's 24-word recovery phrase and sent it over an LTE connection using an embedded eSIM. Unknown attackers then used the phrase to access users' funds, which were drained on 9 October. Ledger has not confirmed total losses and urged people not to speculate.

Ledger said all confirmed thefts, mostly reported in Southeast Asia, involve CryptoBilis devices, but it is also reviewing reports of implants in other devices and locations. It has not named the affected models. Because the implants leave the Secure Element, a key security feature, intact, tampered devices may still pass Ledger's authenticity checks. Ledger believes the volume of impacted devices is limited. CryptoBilis said it has paused all sales and shipments of Ledger devices and is cooperating with the investigation.

Ledger's advice is clear. Anyone who bought from CryptoBilis and has not set up the device should not do so and should contact Ledger Support. Those who have already set one up should promptly move their assets to a new wallet with a new recovery phrase. Never enter or restore a recovery phrase on a CryptoBilis device. Victims should contact Ledger and local law enforcement before opening or shipping affected devices.