Ledger has detailed how a hidden hardware implant found in devices linked to the CryptoBilis incident could steal cryptocurrency recovery phrases by reading the device’s screen and transmitting the information over a cellular connection. The company’s security research team said the component did not modify Ledger’s Secure Element or operating system, or alter transactions and signatures.
In an October 13 update, Ledger’s Donjon, the company’s in-house security research lab, explained how the implant operates. The findings provide a technical explanation for how a tampered device could expose a wallet’s recovery phrase without breaking the cryptographic protections used to sign transactions.
The incident concerns devices sold through Southeast Asian reseller CryptoBilis. Ledger has confirmed finding an unauthorized hardware implant in an affected user’s device, but the company has not confirmed the total number of affected users or the total value of cryptocurrency lost.
How the CryptoBilis Implant Works
According to the Donjon’s analysis, the implant sits inside the device enclosure and reads information displayed on its screen. During initial setup, a Ledger signer displays the user’s 24-word recovery phrase so it can be recorded and stored securely.
The implant detects the screens displaying the recovery words, decodes the information and transmits it over LTE using a provisioned eSIM, Ledger said. In practical terms, the component can capture the recovery phrase at the moment it appears on the display. If an attacker obtains that phrase, they can restore the associated wallet on another device and attempt to transfer its assets without needing the original hardware wallet.
The cellular connection provides a separate route for transmitting the captured information. This means the implant does not need to alter the wallet’s normal transaction-signing process to expose the recovery phrase. Ledger’s findings describe a physical hardware compromise rather than a demonstrated breach of the company’s core cryptographic technology.
The Secure Element Was Not Modified
Ledger stressed that the implant does not modify the Secure Element or the Ledger operating system, and does not alter transactions or signatures. Instead, it operates as a separate component inside the device.
The Secure Element is designed to protect sensitive cryptographic operations and private-key material. However, the CryptoBilis incident illustrates a different risk: a recovery phrase can be exposed if a malicious component captures it when the device deliberately displays it during setup. The distinction is important. A hardware wallet’s security depends not only on its cryptographic design but also on the integrity of the physical device and the path it takes from production to the customer.
The Donjon’s explanation does not mean that all Ledger devices are affected. Ledger has said that all confirmed fund losses linked to the October 9 draining incident involve devices sold through CryptoBilis, while its own systems and direct sales channels remain unaffected.
Scale of Losses Remains Unconfirmed
Ledger has not confirmed the total number of affected users or the total value lost in the incident. The company has specifically cautioned that figures circulating online originate from third parties and have not been fully verified by Ledger.
On-chain investigators have published estimates ranging around $93 million as they trace transactions across multiple networks. The investigation has also raised questions about whether hardware tampering extends beyond the original reseller. Ledger said it is reviewing reports of implants found in other devices and locations, but has not confirmed that those reports are connected to the CryptoBilis-linked fund drains.
CryptoBilis has confirmed that it stopped selling hardware wallets while the investigation continues. The distinction between confirmed findings and independent reports remains important: the presence of a hardware implant establishes that physical tampering occurred in at least one affected device, but it does not independently establish the mechanism behind every reported loss.
The Crypto Times previously covered the developing investigation in its reports on Ledger’s initial probe into CryptoBilis and reports of a hidden chip and warnings from Binance co-founder Changpeng Zhao.
Reports of Tampered Wallets in Europe and Asia Remain Unresolved
The Donjon’s October 13 update explains how the CryptoBilis-linked implant could capture recovery phrases and transmit them over LTE. However, the technical analysis does not address the separate reports of potentially tampered Ledger devices found in Europe and other parts of Asia, or establish whether those devices are connected to the confirmed fund-draining incident.
Researchers have raised concerns about devices obtained through different sellers and distribution channels. Former Mt. Gox CEO Mark Karpelès reported finding a suspicious component in a Ledger device shipped from Malaysia. Separately, research from Tibane Labs described suspicious modifications in Ledger Nano X devices obtained through sellers in Japan, including devices reportedly shipped from Malaysia.
Security researcher Johannes, posting as @0xJohannes_ on X, also reported finding what appeared to be a hardware implant in a Ledger device purchased from MediaMarkt, a European electronics retailer. The report raised concerns that suspicious components may not be limited to devices sold through CryptoBilis.
These findings are reports of suspicious hardware, not confirmation that all the devices share a common source or were involved in the October 9 fund drains. The European device report, in particular, has not been established by Ledger as part of the confirmed CryptoBilis-linked incident.
Ledger has said it is reviewing reports of implants in other devices and locations. Its earlier statements, however, maintained that all confirmed fund losses associated with the October 9 incident involved devices sold through CryptoBilis.
The October 13 technical update does not provide a confirmed count of tampered devices across regions or clarify whether the separately reported European and Asian findings are connected to the CryptoBilis investigation. Those questions remain unresolved.
Ledger CTO Outlines Response and Safety Guidance
Ledger’s CTO, Charles Guillemet, has also addressed the incident, saying the company’s teams are focused on the investigation and reiterating its guidance for users who may have received a tampered device.
The CTO said Ledger is reviewing its reseller controls and anti-tamper protections as it investigates the incident. The company has also invited security researchers and hardware vendors to collaborate on identifying and understanding suspicious modifications.
The response adds a broader security review to the technical findings published by Ledger Donjon on October 13. However, it does not establish whether the separately reported devices in Europe and Asia are linked to the CryptoBilis case, nor does it confirm the number of devices affected across distribution channels.
Ledger’s technical update and the CTO’s comments should therefore be read separately from unverified estimates of stolen funds and reports of suspicious hardware that the company has not confirmed as part of the October 9 incident. Users should follow Ledger’s official guidance and avoid relying on unverified claims about the scope of the compromise.
What Ledger Says Users Should Do
Ledger’s guidance distinguishes between customers who have not yet initialized their devices and those who have already used them.
- If you bought a Ledger signer from CryptoBilis and have not set it up, do not initialize it. Contact official Ledger Support for instructions.
- If you have already set it up, transfer your assets promptly to a new signer with a newly generated recovery phrase, following Ledger’s guidance. Do not reuse a potentially exposed recovery phrase.
- If you have a tampered device, contact Ledger Support before sending it anywhere. Follow the company’s instructions for handling and shipping it.
- If you lost funds, report the incident to local law enforcement. Coordinate with authorities before opening or sending the device so potential physical evidence is preserved.
- Never disclose your recovery phrase. Do not enter it into a website, app or online form, and do not share it with anyone claiming to offer technical support or asset recovery.
Users who did not purchase through CryptoBilis but want to inspect their devices can consult Ledger’s device inspection guide. Ledger warns that opening a signer can damage it and advises users to back up their recovery phrase first. Given the risk of exposing sensitive information or damaging the device, users should follow the manufacturer’s instructions carefully.
What the Incident Means for Hardware Wallet Security
The Donjon’s analysis makes the suspected attack mechanism more specific: the implant could capture recovery words from the screen and send them over a cellular connection, bypassing the need to modify the device’s transaction-signing process.
The broader lesson is that cryptographic protections cannot, on their own, prevent every risk introduced by physical tampering. A device can use a genuine Secure Element and retain its normal operating system while an unauthorized component creates a separate route for exposing sensitive information.
Ledger’s investigation remains ongoing. The company has not published a confirmed total for losses or affected users, and reports of implants outside the CryptoBilis incident remain under review. For now, affected customers should prioritize Ledger’s official guidance, preserve potentially relevant evidence and be alert to scams that exploit the incident. The company says it will share further findings as they are verified.
The Crypto Times has contacted Ledger, but is yet to receive an update.
