Key Insights:
- Ledger Hack News: CEO Pascal Gauthier leads the CryptoBilis wallet tampering investigation.
- Ledger confirms a hardware implant transmitted 24-word recovery phrases via LTE.
- CryptoBilis halts Ledger wallet sales as reported $86M losses remain unverified.
Ledger wallet hack prompted CEO Pascal Gauthier to lead an investigation into devices sold by Southeast Asian reseller CryptoBilis.
The company is examining unauthorized hardware implants after customers reported missing cryptocurrency funds on October 9. Gauthier said his executive team is directing resources toward identifying those responsible and determining where the devices were altered.
The investigation has confirmed an implant in one affected signer, but the broader scale remains unknown.
Ledger Wallet Investigation Focuses on Supply Chain
Gauthier said investigators have not identified who installed the unauthorized components or where tampering occurred.
The inquiry now includes devices submitted for inspection and customer reports reviewed by Ledger Support. Ledger’s Donjon security team will examine additional signers as they arrive.
The company is contacting affected customers and working with law enforcement during the investigation. As a result, CryptoBilis has stopped selling Ledger signers while investigators examine the incident. Ledger also plans to review safeguards covering its direct sales and reseller distribution channels.
Gauthier invited security researchers and other hardware vendors to collaborate on chain-of-custody and tamper-detection practices.
He said the company would communicate verified findings through its authorized channels as the inquiry progresses. Ledger reported no indication that its own infrastructure, systems, or services had been compromised.
How the Unauthorized Implant Captured Recovery Phrases
Ledger’s Donjon team described a separate component concealed inside an affected signer’s enclosure. During initial setup, a signer displays a 24-word recovery phrase on its screen. The implant monitors the display, detects those screens, and uses a microcontroller to decode the words.
The component then transmits the recovered phrase over an LTE connection using a provisioned eSIM. Ledger said the implant does not change the Secure Element or the device’s operating system. It also does not modify transactions or signatures.
Ledger confirmed the unauthorized implant of the Ledger wallet on October 10, one day after the reported fund losses. The company has linked all confirmed losses in that incident to signers sold through CryptoBilis. However, it has not verified any associated fund drain involving a signer purchased elsewhere.
An earlier report cited blockchain investigator Specter’s estimate of losses exceeding $86 million. Ledger has not confirmed that figure and says circulating loss estimates remain unverified. It is also reviewing reports of possible implants in other signers and locations.
Customer Instructions as Ledger Wallet Hack Probe Continues
Ledger instructed CryptoBilis customers not to initialize any signer they purchased but have not configured.
Customers who have already completed setup should move their assets to a new signer with a newly generated recovery phrase. The company warned users against entering or restoring recovery phrases on devices purchased from that reseller.
Affected customers should contact Ledger Support through its official website and report losses to local law enforcement.
Those holding suspected tampered devices should seek guidance before sending them anywhere. Customers who lost funds on the Ledger wallet should also coordinate with authorities before opening their accounts.
Ledger cautioned that it never requests recovery phrases through calls or direct messages. CryptoBilis separately warned buyers against preprinted recovery phrases and offers to recover stolen funds.
Both companies advised customers to avoid sharing recovery phrases or PINs. In addition to the sentiment, the Ledger wallet hack investigation remains open as security teams examine additional devices and evaluate customer reports.
