Ledger Confirms Hardware Wallets Sold by CryptoBilis Were Implanted with Components Capable of Stealing Seed Phrases

Odaily News: According to Ledger monitoring, its security team Ledger Donjon is investigating Ledger signing devices (signers) sold by Southeast Asian distributor CryptoBilis. The batch of devices was implanted with unauthorized hardware components, and Ledger confirmed on October 10 that one user's device was affected. Ledger Donjon's analysis shows that the implant is located inside the device casing and can read the screen display contents, decode the 24-word recovery seed phrase during initial setup, and transmit it externally via a built-in eSIM and LTE. The component does not modify the secure chip, system, or transaction signing. Currently, all confirmed fund losses related to the incident disclosed on October 9 involve devices sold through CryptoBilis. CryptoBilis has stopped selling Ledger devices.