Hidden hardware implants found in Southeast Asian Ledger wallets

Ledger confirmed the presence of the covert device on October 10 following reports of missing funds. According to the company's Donjon security team, the implant operates independently from the wallet’s core security architecture. It does not compromise the Secure Element or the device’s operating system, but rather uses a separate microcontroller to monitor the wallet's screen during the initial setup process, capturing sensitive recovery phrases as they are displayed.

CryptoBilis has suspended all sales of Ledger hardware while investigators work to determine how the unauthorized components were installed. While blockchain analytics firm Bitquery has estimated potential losses reaching $102 million across hundreds of wallets, Ledger has not yet verified the total number of victims or the precise financial impact. The company emphasized that its investigation has not linked these specific hardware modifications to distribution channels outside of the affected reseller.

Owners of devices purchased through CryptoBilis are advised to cease use immediately. Ledger recommends that those who have already initialized their wallets transfer assets to a new device using a fresh recovery phrase. Users should avoid importing their existing recovery words into any new hardware, as these credentials may already be compromised. Investigations into the origin of the implants and the extent of the tampering remain ongoing, with the company coordinating with law enforcement to address the security breach.