Overview
- Ledger disclosed that probes triggered by public reports on October 9th found unauthorized electronics in units sold by Southeast Asian reseller CryptoBilis that read the device screen during setup and transmitted the recovery phrase over an LTE/eSIM link.
- Technical analysis shows the implants sit alongside Ledger’s intact Secure Element so the company’s Genuine Check can still pass while the added hardware records the 24‑word seed and exfiltrates it, letting attackers restore and drain wallets remotely.
- Independent on‑chain firms have traced suspected theft flows in the high tens of millions of dollars, with estimates commonly cited around $86M–$91M, although Ledger says those totals remain unverified as law enforcement and forensic work continue.
- Chainalysis identified one operator of a ‘task scam’ who parked proceeds in three Ledger addresses that were emptied on October 9th for roughly 60 BTC, about $4.8–$4.9 million, illustrating both criminal use of compromised wallets and secondary thefts.
- Resellers including CryptoBilis paused sales after Ledger’s request, some vendors cut ties, and users are being told not to initialize devices bought from the reseller in the past 90 days and to move funds if a device was already set up as investigations and freezes proceed.