Ledger Supply Chain Investigation: Risk Tied to CryptoBilis Devices
Ledger's security team updated its investigation on October 13, confirming that some hardware wallets sold through the Southeast Asian reseller CryptoBilis contained unauthorized implants. The hidden component sits inside the device shell and can read on-screen information. During initialization, it can capture the 24-word seed phrase and send the data out over LTE using a built-in microcontroller and eSIM.
Why the implant is hard to detect
The module operates independently and does not modify the Secure Element, the Ledger operating system, or transaction signing. The wallet may continue to behave normally while sensitive data is collected through a hardware bypass. This shifts the attack from software compromise into the physical supply chain, making it easier for users to miss.
Confirmed losses and open questions
So far, all confirmed losses from the thefts disclosed on October 9 involve devices from the CryptoBilis channel. No related cases have been verified through other sales channels. CryptoBilis has paused Ledger product sales while the investigation continues. Ledger has not confirmed the total number of affected users or the total loss amount, and circulating figures remain unverified.
What users should do now
- Uninitialized devices: do not set them up, do not generate or reveal seed phrases, and stop using them.
- Already initialized devices: move assets to a new device and create a fresh seed phrase immediately.
- Do not restore seed phrases on the affected device.
- Contact Ledger through official support channels and report the incident to local law enforcement.
Buying guidance
Ledger says products sold through official channels and direct sales were not affected. Buyers should use authorized channels only and treat any request for a seed phrase, private key, or recovery phrase as a serious warning sign.