Ledger says unauthorized hardware implanted in some of its signing devices sold through Southeast Asian reseller CryptoBilis captured users’ 24-word recovery phrases from the devices’ screens and transmitted the data over cellular networks.
The findings clarify how an attacker could defeat the practical protection of a hardware wallet without compromising its secure chip or changing a transaction. According to Ledger’s Donjon security team, the added component watched data sent to the display during setup, decoded the recovery words and sent them over LTE using a provisioned embedded SIM.
Ledger said it confirmed an implant in one affected user’s device on October 10. All fund losses it had confirmed in connection with the incident as of October 13 involved devices sold through CryptoBilis. The company said it had not verified a loss tied to a device purchased elsewhere.
The attack targeted the recovery process
A hardware wallet is designed to keep signing keys isolated and let users verify transactions on a trusted display. This incident shows that the setup and recovery process is also a critical security boundary. Anyone who obtains a complete recovery phrase can recreate the wallet on another device and move its assets without altering the original device’s operating system, secure element or later transaction signatures.
Ledger said the implant was a separate component inside the enclosure. Its analysis found no modification to the secure element or Ledger operating system and no manipulation of transactions or signatures. That distinction narrows the demonstrated attack: the compromise was designed to steal the backup secret when it appeared on screen, not to rewrite payments as users approved them.
The company has not confirmed the total number of affected users or the value of funds lost. Third-party loss estimates circulating online therefore remain unverified and are not a reliable measure of the incident’s scope. Ledger said it is reviewing reports concerning other devices and locations, but it has not established a connection between those reports and the confirmed CryptoBilis case.
Reseller controls become part of wallet security
For wallet providers and crypto-payment businesses, the incident turns distribution governance into a direct asset-security issue. A device may pass software checks and preserve its secure element while an added component compromises the recovery phrase at the point of display. Controls focused only on firmware integrity cannot address that physical supply-chain risk.
The response has spread beyond Ledger. OneKey said it had received no reports of related losses among its users, but ended CryptoBilis’ reseller authorization, paused onboarding new resellers and began a new review of its distribution network. It also offered replacements for eligible devices bought from CryptoBilis from March 1 through October 12. Trezor likewise said it had no reports or indications that its devices were affected, while removing CryptoBilis from its reseller list as a precaution.
Those steps do not establish that other wallet brands were compromised. They do show how a suspected reseller-channel breach can force vendors to reassess authorization, ownership checks and replacement procedures across an entire distribution network.
What affected users were told to do
Ledger advised customers who bought one of its devices from CryptoBilis but have not configured it not to set it up and to contact Ledger Support. Customers who already configured one were told to move assets promptly to a new device protected by a newly generated recovery phrase, rather than restoring the old phrase.
The company also told customers who lost funds or possess a tampered device to contact support and local law enforcement before sending the device away or opening it. Ledger warned that opening a device can damage it. Trezor separately cautioned users not to force open its devices, particularly battery-powered models.
The operational lesson for payment providers is broader than where a device was purchased. Wallet onboarding, reseller vetting, tamper investigation and recovery-phrase rotation need to be treated as connected controls. In this case, Ledger’s evidence indicates that the transaction-signing architecture remained intact while the secret underpinning the wallet was exposed earlier in the user journey.