On October 13, Ledger's Donjon security team described an unauthorized implant inside signers sold by Southeast Asian reseller CryptoBilis. The chip sits in the enclosure, reads the 24-word recovery phrase off the screen during setup, and sends those words over LTE through a provisioned eSIM. Ledger's update says the implant is a separate part. It doesn't modify the Secure Element, the Ledger operating system, transactions, or signatures.
The signer shows the 24 words while you set it up. The implant's microcontroller spots those screens, decodes the words, and transmits them. The device can keep producing ordinary signatures after that. Whoever holds the phrase can restore the wallet somewhere else and move the funds without touching the signer again.
Confirmed fund losses from the October 9 incident are still CryptoBilis-scoped. That update says Ledger hasn't verified a drain from a signer bought anywhere else, and it hasn't confirmed a victim count or a dollar total. Figures circulating online come from third parties. Our October 9 scorecard walked through those unconfirmed totals. This Donjon update names the mechanism. It leaves the loss tally where it was.
Genuine Check stops at the chip
The Record reports that Ledger hasn't named the affected models, and that a tampered device can still pass the company's authenticity checks because the implant leaves the Secure Element intact. That test is Genuine Check. It confirms the secure chip answered. It can't see a physical spy implant sitting beside an untouched chip, so a pass doesn't clear a CryptoBilis unit and doesn't stand in for the box's supply-chain history.
CoinDesk describes the thefts as a physical supply-chain attack, with Ledger still investigating where the devices were tampered with.
The same day, Ledger asked resellers and distributors in Southeast Asia and Hong Kong to suspend sales and take devices off the shelves. The markets it named are Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong. Confirmed incidents, it says, remain in Southeast Asia. Ledger has no indication that its infrastructure, systems, services, or direct sales channel were compromised. A separate Ledger note says MediaMarkt Saturn stopped selling Ledger devices in its stores and online, with Ledger's alignment, after one customer in Germany reported an implant. No loss of funds was reported in that case.
If you bought a signer from CryptoBilis and you haven't set it up, don't set it up. If you already did, move the funds to a new signer and generate a new recovery phrase on that device. Leave the old phrase off the replacement. Buy the new one from Ledger directly. Don't open the suspect signer or ship it until you've spoken with Ledger Support and local law enforcement. Ledger will never ask you for the 24 words.
Photo: Raimond Spekking / Wikimedia Commons, CC BY-SA 4.0.
