Ledger Confirms Southeast Asian Distributor CryptoBilis Sold Hardware Wallets with Malicious Components Capable of Stealing Recovery Phrases

PANews, October 13 — According to an official statement from Ledger, its security team Ledger Donjon is investigating Ledger signer devices sold by Southeast Asian distributor CryptoBilis, which were found to contain unauthorized hardware components. Ledger confirmed the issue on October 10 regarding a device of an affected user. Donjon's analysis shows that the implanted component is located inside the device casing and can read screen display content—decoding the 24-word recovery phrase during initial setup and transmitting it externally via LTE through a built-in eSIM; this component does not alter the security chip, system, or transaction signing. Currently, confirmed fund losses related to the incident disclosed on October 9 all involve devices sold through CryptoBilis. CryptoBilis has stopped selling Ledger devices. The total number of affected users and the amount of losses have not yet been verified, and Ledger is screening for similar implant reports from other distributors and regions.