What happened
Ledger has begun reviewing its sales policies and how its devices reach customers after the "Cryptobilis incident," in which physical tampering along its supply chain led to $93 million in cryptocurrency theft from user wallets. CTO Charles Guillemet said tampered devices should be sent to Ledger support for examination.
How the attack worked
The incident was first noticed on Friday, October 9, when hundreds of wallets were drained simultaneously across the Bitcoin, Ethereum, and Tron networks. Investigation revealed that almost all affected wallets had been purchased from CryptoBilis, an authorized third-party reseller covering Malaysia and Southeast Asia. Ledger ordered CryptoBilis to halt all sales and shipments.
According to an October 10 announcement, an affected device contained an unauthorized hardware implant with a cellular/LTE module. Attackers had manually installed these chips in brand-new devices at some point in the supply chain. When a user generated or verified their 24-word recovery phrase on the wallet's screen during setup, the rogue chip recorded the OLED output or read the raw data lines carrying the text, then silently transmitted the unencrypted phrase over LTE to the attackers' servers. This allowed them to clone private keys and drain funds.
Ledger's response
Ledger stresses that its internal infrastructure, firmware code, and direct-to-consumer sales through its official store remain uncompromised. The company advises users with wallets from third-party resellers to move funds to a separate wallet secured by a freshly generated, uncompromised recovery phrase. It is also instructing distributors to enforce tighter tracking, source only through approved channels, and strictly ban the restocking or resale of returned units. Ledger is inviting researchers and other vendors to collaborate in assessing these practices.
