Ledger confirms hardware wallets sold by Southeast Asian distributor CryptoBilis have been implanted with malicious chips, as authorities conduct an investigation.

According to official disclosures from Ledger, its security team, Ledger Donjon, is investigating Ledger signing devices (hardware wallets) sold by the Southeast Asian distributor CryptoBilis. It has been confirmed that the affected devices contain unauthorized hardware implants. All confirmed financial losses are linked to devices sold through CryptoBilis, with no evidence yet of theft from devices purchased through other channels. CryptoBilis has now suspended sales of Ledger devices. Investigative analysis reveals that the implant is located inside the device casing and is designed to read data displayed on the screen. During the user initialization setup, the implant decodes the 24-word mnemonic phrase displayed on the screen via a microcontroller and transmits it externally using a pre-configured eSIM card over an LTE network. The implant operates as an independent component and does not tamper with the Secure Element or the Ledger operating system, nor does it alter transactions or signatures.