A SecurityWeek report details a supply-chain compromise affecting Ledger signers sold via Southeast Asia’s CryptoBilis reseller. The investigation indicates an unauthorised hardware implant was added to the devices, designed to intercept user data during setup. The attackers allegedly relied on modified signers whose enclosures contained a hidden microcontroller that can read the screen-displayed recovery phrase and transmit it to the attackers over LTE via a provisioned eSIM.
Ledger has stated that the implant’s function is information interception only and does not alter the device’s operating system, transactions, or signatures.
The incident is linked to a wallet recovery phrase exposure, with losses so far reported by on-chain researchers as potentially reaching around $86 million, though Ledger has not confirmed the total number of affected customers or the exact sum stolen. The company urged CryptoBilis customers to halt sales and advised Ledger users who bought from the reseller in the past 90 days not to begin setup if possible, recommending those who have already set up to move funds to a new Ledger signer with a fresh seed.
Authorities and investigators are watching the distribution chain for further indicators of compromise, while Ledger emphasises that the problem lies with compromised supply, not an inherent flaw in Ledger firmware.