Ledger has pledged to review its reseller policies and strengthen device security while continuing its investigation into who tampered with cryptocurrency hardware wallets sold through Southeast Asian reseller CryptoBilis.
In an update posted on X on Tuesday, Ledger said hidden hardware installed inside some devices captured users’ 24-word recovery phrases directly from the screen and transmitted the information to an attacker through a mobile network.
According to the company, the concealed component was embedded inside the device casing. When users configured their wallets and the recovery phrase appeared on the screen, the implant’s microcontroller identified and decoded the words before transmitting them over LTE using an embedded SIM (eSIM).
A recovery phrase is the master key to a cryptocurrency wallet. Anyone who obtains it can recreate the wallet on another device and transfer its funds without needing the original hardware wallet or interfering with its transaction records.
Ledger’s disclosure offers the first public explanation of the method allegedly used in the CryptoBilis-linked thefts. The company said the implant did not alter the device’s Secure Element, which is designed to safeguard private keys, or its operating system. Transactions and digital signatures also remained unchanged. Ledger described the incident as a physical supply-chain attack rather than a compromise of its software or internal infrastructure.
The company said its investigation would continue until those responsible for modifying the devices were identified. It also confirmed plans to reassess reseller controls and strengthen anti-tampering measures.
Ledger Chief Technology Officer Charles Guillemet said the company was reviewing its reseller safeguards and protections against unauthorized hardware modifications. He also called on security researchers and other manufacturers to collaborate on improving tamper detection and supply-chain tracking.
CEO Pascal Gauthier said Ledger was examining the safeguards governing both direct sales and third-party distribution. He added that investigators were working to determine who modified the affected devices and where in the supply chain the tampering occurred.
Separately, Mark Karpeles, the former CEO of bitcoin exchange Mt. Gox, claimed that he discovered a surveillance implant in a Ledger Flex device purchased at Singapore Airport.
Ledger reported confirming an unauthorized implant in one affected signing device. It said all confirmed losses connected to the October 9 incident involved devices distributed by CryptoBilis. The company had not verified any theft involving devices purchased elsewhere, although it was examining additional reports of suspected implants in other devices and locations.
The French hardware wallet manufacturer has not confirmed the total number of affected users or the amount stolen. On-chain researchers estimated that losses may have reached $93.2 million across more than 300 wallets. Tether separately froze $10 million in USDT linked to the incident.
Ledger said CryptoBilis had halted sales of its devices. Customers who purchased a Ledger signer through the reseller were advised not to initialize it. Those who had already used one were urged to transfer their funds to a new device using a newly generated recovery phrase.
