Ledger has confirmed that an unauthorized hardware implant inside signers sold by Southeast Asian reseller CryptoBilis captures the 24-word recovery phrase during device setup and sends it out over LTE.
In an update from its Donjon security team, Ledger said in a post on X that the implant sits inside the enclosure and reads what appears on the screen. During setup, the signer displays the 24-word recovery phrase. When the implant detects those screens, its microcontroller decodes the words and transmits them over an LTE connection through a provisioned eSIM.
That detail matters because of what the implant does not do. Ledger’s security team said the component is separate from the device’s core: it does not modify the Secure Element, the Ledger operating system, or any transactions and signatures. The device itself signs honestly. The attack works only at the one moment a seed phrase is exposed on screen, during setup, which is why Ledger’s guidance is blunt: “If you bought a Ledger signer from CryptoBilis and have not set it up, do not set it up and contact Ledger Support. If you have set it up, transfer your assets promptly to a new signer with a new recovery phrase.”
All fund losses Ledger has confirmed, disclosed on October 9, involve signers sold through CryptoBilis. The company says it has no indication its own infrastructure, systems or services were compromised, and asked CryptoBilis to pause all sales and shipments while its team examines recovered hardware.
The same day, Ledger confirmed in a follow-up post that MediaMarkt Saturn stopped selling Ledger devices in stores and online across Europe as of October 13, after one customer in Germany reported an implant. No loss of funds was reported in that case. Onchain researchers have estimated losses at more than $86 million across Bitcoin, Ethereum and Tron, a figure Ledger says it has not verified.
Whether the German device connects to the CryptoBilis attack is not confirmed. Ledger says its Donjon team is reviewing reports of implants in other signers and locations, and will share more as the investigation continues.
