Ledger confirms hardware wallets sold by Southeast Asian distributor CryptoBilis have been implanted with malicious chips, as authorities conduct an investigation.

On October 13, Ledger officially disclosed that its security team, Ledger Donjon, is investigating Ledger signing devices (hardware wallets) sold by Southeast Asian distributor CryptoBilis. It has been confirmed that these devices contain unauthorized hardware implants. All currently confirmed financial losses are linked to devices sold through CryptoBilis, and there is no evidence to date that devices purchased through other channels have been compromised. CryptoBilis has now suspended sales of Ledger products.

Investigation analysis indicates that the implant is housed inside the casing and designed to read data displayed on the screen. During the initial setup process, the implant utilizes a microcontroller to decode the 24 mnemonic words shown on the display and transmits them externally via a pre-configured eSIM card over an LTE network. This implant operates as an independent module and does not tamper with the Secure Element or Ledger OS, nor does it alter any transactions or digital signatures. The total number of affected users and exact loss amounts have not yet been fully verified. Ledger urges customers who purchased devices through this channel to stop the initialization process, immediately transfer their assets, and reach out to official technical support.