Mentioned in This Article
1. What did the Ledger hack involve?
Ledger disclosed on Tuesday, October 13, that some of its hardware wallets sold by the Southeast Asian reseller CryptoBilis contained a covert implant that read users' 24-word recovery phrases from the device screen and sent them to an attacker over a mobile network. Onchain researchers estimate that more than 300 wallets lost as much as $93.2 million, while Tether froze $10 million of USDT linked to the theft.
The French hardware-wallet maker published the finding in an investigation update on X. It is the company's first public explanation of how the thefts tied to CryptoBilis devices were carried out, and it answers the central question that had hung over the incident since losses began to surface on October 9: how funds could leave wallets that were protected by a hardware signer.
2. How did the implant capture the recovery phrase?
According to Ledger, the malicious component sat inside the casing of the affected devices. When a buyer set up the signer for the first time, the screen displayed the recovery phrase so that the owner could write it down. At that moment a microcontroller in the implant recognized the words on the display and decoded them.
The implant then transmitted the phrase over LTE, a cellular data standard, by way of an eSIM. In practical terms, the tampered device carried its own small mobile data connection, which meant it did not need the owner's computer, phone or home network to send information out. A user could follow every on-screen instruction correctly and still hand the phrase to a third party the moment it appeared.
The design explains why the thefts could be carried out without any visible sign of tampering in the way the wallet behaved. Nothing about the signing process had to be altered for the attacker to profit. The thieves simply needed the words, which were delivered to them as the owner completed setup.
3. Why is a recovery phrase so valuable?
A recovery phrase, often called a seed phrase, is the master key to a crypto wallet. The 24 words encode the secret from which every private key in the wallet is derived. Anyone who holds the phrase can recreate the wallet on another device and move the funds out, with no need for the physical signer and no need to alter any transaction the owner approves.
That property is the reason hardware wallets exist. By keeping private keys inside a dedicated device, they are meant to ensure that the secret never touches an internet-connected computer. The recovery phrase is the one moment in the life of a wallet when that secret is shown in readable form, and it is intended to be seen only by the owner and written on paper. An attacker who can observe that single screen therefore obtains everything, regardless of how strong the device's other protections are.
It also means the compromise is silent. Because the thief controls a full copy of the wallet, no malicious transaction has to pass through the owner's device. The first sign of trouble is usually an emptied balance.
4. What does Ledger say was and was not compromised?
Ledger characterizes the episode as a physical supply-chain attack rather than a breach of its own technology. The company says the implant did not modify the secure element, the chip designed to hold keys and resist extraction, and did not change the operating system running on the device. It also says the implant did not alter transactions or signatures, and that Ledger's software and internal systems were not affected.
That distinction matters for how the risk is understood. A supply-chain attack targets the path a product travels between the manufacturer and the customer. Here, the hardware that reached buyers through a reseller had an extra component added to it. The attacker did not need to break the security model of the signer; the plan was to observe what the signer legitimately displays.
The company's account therefore places the problem at the point of sale and handling rather than in the firmware or the cryptography. Whether that framing reassures users will depend on how many devices turn out to have been tampered with and where they were sold, questions Ledger says it is still working through.
5. How far does the problem extend beyond CryptoBilis?
Ledger had already confirmed in an earlier update that at least one affected signer contained an unauthorized implant. In the latest statement it says every confirmed loss in the October 9 incident involved a device sold by CryptoBilis. The company says it has not verified a theft from a signer purchased from any other seller.
It is nonetheless examining reports of implants in other devices and in other locations. That wording leaves open the possibility that the tampering was not confined to one reseller, though the company has not said that it was. Until the review is complete, the safest reading of the evidence is that confirmed thefts trace to a single sales channel while the investigation of other channels remains active.
Ledger has not confirmed the total number of victims or the amount stolen. The figures of more than 300 wallets and up to $93.2 million come from onchain researchers who traced funds moving out of wallets linked to the affected devices, not from the company. Onchain tracing can identify the addresses involved and the size of the outflows, but it cannot always establish which device an owner used, so such totals are best treated as estimates.
6. Why are supply-chain attacks hard for buyers to spot?
A supply-chain attack works by compromising a product before it reaches its owner, which is why it is difficult to detect from the outside. The buyer receives a device that powers on, shows the expected menus and passes the on-screen steps, so ordinary use gives no signal that anything is wrong. The malicious part is built to stay quiet, drawing little power and sending data only at the moment it matters.
Security reviews of consumer hardware usually focus on the chip that holds keys and on the software that runs on it. Those are the components a manufacturer controls and can test. An extra component fitted inside the enclosure sits outside both. It does not need to defeat the secure element because it never touches it; it only has to watch the screen that the owner is also watching.
The use of cellular connectivity adds to the difficulty. A device that can reach a mobile network on its own does not depend on any network the owner controls, so a home firewall, a router log or a disconnected computer would not reveal or block the transmission. That is a notable feature of the mechanism Ledger describes, and it is part of why the incident drew attention beyond the immediate victims.
7. How can buyers lower the risk of a tampered signer?
The most direct step is to buy hardware wallets from the manufacturer or an authorized seller, which Ledger's guidance for this case implicitly supports by singling out the reseller channel. A third-party seller adds handling steps that the maker does not oversee, and each step is an opportunity for modification.
A second step is to treat any recovery phrase that may have been exposed as compromised and to rotate to a new one without delay. In the present case Ledger tells affected customers to do exactly that, moving assets to a device with a freshly generated phrase. Doing so is inexpensive compared with the loss that follows if the old phrase has been copied.
A third consideration is the setup moment itself. Because the recovery phrase is displayed once, in readable form, on the screen of the signer, the integrity of the hardware at that instant is what determines whether the phrase stays private. Users who have any doubt about where a device came from have reason to stop before setup rather than after it.
8. What should owners of CryptoBilis-sold devices do?
Ledger says CryptoBilis has stopped selling its signers. For customers who bought a Ledger device from the reseller but have not yet set it up, the guidance is not to initialize it. Turning the device on and generating a recovery phrase is exactly the step during which the implant, according to the company, captures the words.
Owners who already set up a device bought from the reseller are told to move their assets to a new device with a newly generated recovery phrase. The reasoning follows from the mechanism: if the old phrase was displayed on a compromised signer, it should be treated as known to the attacker, and no amount of changing passwords or PINs on the old device would restore its secrecy. Only a fresh phrase, created on trustworthy hardware, produces keys that the thief has never seen.
The advice also illustrates a broader rule of hardware-wallet security. Devices are safest when bought directly from the manufacturer or an authorized channel, and a seller that is not the maker adds a link in the chain that the buyer cannot inspect. A sealed box and an intact casing are only partial evidence, because an implant can be fitted inside the enclosure before the product is repackaged.
9. What happens next?
Ledger's investigation is continuing. The open items named in its update are the review of implant reports from other devices and locations, and the still unconfirmed count of victims and total losses. The company has not given a date for a further update.
On the recovery side, Tether's freeze of $10 million in USDT shows that part of the stolen value sat in a stablecoin whose issuer can block transfers, which gives investigators at least some leverage. Funds held in assets without a central issuer are harder to halt once they leave the victim's wallet.
For the wider market, the incident is a reminder that the weakest point of a well-designed security product can be the route it takes to the customer. Buyers of any signing device now have a concrete example to weigh when deciding where to purchase one.