Ledger confirmed that a device belonging to one user connected to the CryptoBilis investigation contained an unauthorized hardware implant. In an update reported by The Hacker News, the company said the component read the recovery phrase shown on the screen during setup. Ledger has not confirmed the total number of affected users or the total value lost.
TL;DR: Ledger confirmed an implant in one user’s device, not in every signer sold through a reseller. Bitquery’s on-chain investigation counts $102.0 million across 324 wallets on six networks. Ledger says it has not confirmed that total or checked Bitquery’s count.
What Did Ledger Confirm About the CryptoBilis Device?
Ledger said an affected user’s device contained an unauthorized implant. The company described it as a physical hardware modification, not a change to Ledger’s software. In the same update, Ledger described the confirmed cases as limited and said they involved devices sold through CryptoBilis, a reseller in Southeast Asia. The Hacker News reported both statements.
Those findings have narrower scope than some headlines suggest. Confirmation of an implant in one device does not establish that every Ledger signer, or every unit sold through CryptoBilis, was modified. Linking confirmed losses to one sales channel also does not establish how the keys for every wallet tracked by blockchain analysts were obtained.
How Did the Implant Capture a Recovery Phrase?
Ledger’s technical account, reported by The Hacker News, says the component sat inside the enclosure and read information on the screen. During setup, the signer displays a 24-word recovery phrase. The added microcontroller recognized those screens, decoded the words and sent them over LTE using a provisioned eSIM.
Ledger said the implant was a separate component. It did not modify the Secure Element or the operating system, and it did not alter transactions or signatures. The described mechanism therefore involved reading the display, rather than changing the signer’s software or transaction-signing behavior.
A recovery phrase can restore access to a wallet on another device. Capturing it during setup can expose the assets controlled by that phrase. That explains the risk in the reported mechanism, but it does not show how many users’ phrases were captured or prove that every drained wallet was used with an implanted signer.
How Should the Loss Estimates and Wallet Counts Be Read?
Published figures are estimates, not a Ledger-confirmed total. Bloomberg described an estimate of about $90 million. The live Bitquery investigation reports its own count of $102.0 million from 324 wallets across six networks. Bloomberg’s figure is a separate media estimate, not a total Ledger confirmed. Bitquery’s figure is an on-chain count of wallet flows; it does not establish that every counted wallet used a device with an implant. Ledger has not confirmed that sum or checked Bitquery’s calculation.
| Network | Amount in Bitquery’s table | Approximate share of its $102.0M count | Source |
|---|---|---|---|
| TRON | $79.3M | 77.7%* | Bitquery |
| Bitcoin | $16.8M | 16.5%* | Bitquery |
| Ethereum | $3.7M | 3.6%* | Bitquery |
| BNB Chain | $1.45M | 1.4%* | Bitquery |
| Polygon | $0.58M | 0.6%* | Bitquery |
| Solana | $0.25M | 0.2%* | Bitquery |
- These shares are calculated from Bitquery’s rounded network amounts and its $102.0M total. They are approximate comparisons, not separate figures reported by Ledger.
Bitquery cautions that transaction tracing does not establish how the keys for every wallet were exposed or whether each drained wallet used a tampered signer. Ledger has not confirmed the total or checked Bitquery’s count.
Did Anyone Breach Ledger’s Systems?
Ledger said it had no indication that its infrastructure, systems or services were compromised. The Hacker News described the incident as involving an added physical component inside a signer, not a confirmed intrusion into Ledger’s servers.
That distinction does not reduce the risk to someone whose recovery phrase was captured. It limits what the available evidence supports: the reports describe hardware tampering, but do not establish a breach of Ledger’s internal systems.
What Does Ledger Genuine Check Verify?
Ledger’s official support documentation describes Genuine Check and says it cannot detect unauthorized physical modifications, such as spying implants, if the original Secure Element remains intact. The check therefore does not establish that every component inside the enclosure is unmodified.
What Was Reported About Devices Beyond CryptoBilis?
The Hacker News reported on October 13 that MediaMarkt Saturn paused sales of Ledger devices after an implant was found in a customer’s device in Germany; no loss of funds was reported in that case. That is a report of a hardware finding, not a confirmed wallet drain.
The same article separately attributes to Tibane Labs a report of three implant variants. According to The Hacker News, researchers assessed the third variant as the most sophisticated; it was purchased on Amazon Japan from a third-party seller based in China, and the parcel shipped from Malaysia. The report does not connect that purchase or the German customer’s device to confirmed CryptoBilis-related losses.
Ledger said confirmed drain-related incidents remained in Southeast Asia and that it had not verified a drain linked to a device bought elsewhere, according to The Hacker News. The reported findings outside CryptoBilis should therefore be treated as separate from the confirmed CryptoBilis-related losses, not combined into a claim that funds were stolen in Germany or through the Amazon Japan sale.
What Should CryptoBilis Customers Do?
Ledger advised customers who bought from CryptoBilis within the previous 90 days and had not set up the device not to initialize it. Customers who had already used one were advised to move assets to a new signer with a newly generated recovery phrase, according to The Hacker News.
In its October 13 update, Ledger also asked resellers and distributors across Southeast Asia and Hong Kong to suspend sales while the investigation continued. The Hacker News said Ledger had not verified a drain linked to a device bought elsewhere.
- Do not initialize an unused device bought through CryptoBilis during the specified period.
- If the device was already used, move assets to a new signer and generate a new recovery phrase.
- Never share the 24-word recovery phrase with anyone claiming to provide support.
- Treat unsolicited offers to recover stolen funds with caution; The Hacker News quoted Ledger’s warning about recovery scams.
These are Ledger’s stated precautions for the affected sales channel. They do not mean that every device sold by CryptoBilis has been shown to contain an implant.
What Remains Unknown?
Ledger has not confirmed the total amount lost or the total number of affected users. Bitquery publishes an on-chain count, but says its analysis cannot determine how the keys for every wallet were exposed or whether every drained wallet was used with a tampered signer.
The Hacker News says the investigation is intended to establish who installed the component and at what stage of distribution. Until further findings are published, three categories should remain distinct: Ledger’s report of an implant in a user’s device, the company’s link between confirmed losses and CryptoBilis-sold devices, and independent estimates of on-chain flows. They do not all have the same evidentiary status.
Frequently Asked Questions
Did Ledger confirm an implant in every CryptoBilis device?
No. Ledger reported an implant in one user’s device and described confirmed cases as limited. It has not published a total number of modified devices.
Did Ledger confirm $102 million in losses?
No. The $102.0 million figure comes from Bitquery’s on-chain analysis of 324 wallets. Ledger has not confirmed that total or checked Bitquery’s count.
Did the implant change Ledger’s software or transactions?
Ledger said it was a separate component that read the screen. The company said it did not modify the Secure Element, operating system, transactions or signatures.
Can Genuine Check detect every hardware implant?
No. Ledger Support says the check cannot detect unauthorized physical modifications if the original Secure Element remains intact.
Summary
Ledger confirmed an unauthorized hardware implant in a user’s device connected to the CryptoBilis investigation. The component reportedly read the recovery phrase shown during setup and transmitted it over LTE, without modifying the Secure Element or operating system.
Bitquery reports an on-chain count of $102.0 million across 324 wallets, but Ledger has not confirmed a total loss figure. Its Genuine Check documentation also says a genuine Secure Element can pass authenticity checks even when another physical component has been added. The full scope of the incident and the source of keys for all tracked wallets remain unresolved.