A hardware wallet can keep transaction signing separate from an internet-connected device. But it cannot protect a recovery phrase exposed during setup. Ledger warned buyers who obtained devices through reseller CryptoBilis after reports of tampered hardware and crypto losses that on-chain researchers estimated at up to $93.2 million.
- Ledger advised buyers not to initialize unused CryptoBilis devices.
- Anyone who had already used one was told to move funds to a wallet with a new recovery phrase.
- Researchers’ estimates are not a final total confirmed by Ledger.
- The attacker and the point of tampering remain unknown.
What Ledger advised CryptoBilis buyers
Ledger’s warning applies to devices bought through CryptoBilis: do not initialize an unused device. If you already used one, Ledger advised moving your assets to a different wallet with a newly generated recovery phrase.
Generate the new phrase on a trusted, uncompromised device, not the potentially affected one. Do not reuse the old phrase. Anyone who has it can restore the wallet elsewhere and access its funds, even without the original hardware.
A recovery phrase, often a sequence of 24 words, is the backup secret that controls a wallet. It is not just a password for the physical device. The device’s security chip cannot help if someone has copied the phrase.
What is known about the reported implant
Ledger began addressing reports of missing funds on Oct. 9. In later updates reported by CoinDesk, Ledger said an unauthorized implant in at least one affected device could recognize recovery words displayed during setup and send them over a mobile network using an eSIM.
That is Ledger’s reported explanation, not an independently established account of what happened to every affected device. CoinDesk also reported Ledger’s statement that the implant did not alter the device’s secure element, operating system, transactions, or signatures.
The distinction matters. A secure element is a protected chip designed to safeguard sensitive information inside a device. But if a recovery phrase is exposed elsewhere, such as on a screen during setup, the chip cannot protect it. The reported attack targeted the backup phrase, not necessarily the wallet’s transaction-signing process.
The incident is best described as a reported physical supply-chain attack. Devices may have been altered somewhere between production and delivery. Ledger said it had no indication that its internal systems, services, or direct sales channels were compromised.
Loss estimates are not a confirmed total
On-chain researchers estimated losses at roughly $86 million to $93 million. CoinDesk later reported an estimate of up to $93.2 million across more than 300 wallets. These are researchers’ estimates, not a final figure confirmed by Ledger or an audited accounting of affected assets.
The available reporting does not name the researchers or explain their full methodology, including how they valued the assets. Treat the figures as estimates, not a precise measure of total losses.
CoinDesk also reported that Tether froze $10 million in USDT linked to the theft. A freeze can stop funds from moving, but it does not mean victims have been repaid. The available information does not establish whether the frozen USDT was returned or included in the researchers’ estimates.
Ledger said all confirmed cases tied to the disclosed draining incident involved devices sold through CryptoBilis. That does not mean every suspected implant report involved the reseller, or that every device mentioned in a report led to stolen funds.
What remains unknown
The attacker’s identity and the point at which devices were tampered with have not been established. Binance co-founder Changpeng Zhao alleged that attackers had bought CryptoBilis and made it sign a nondisclosure agreement. CoinDesk called the allegation unverified and reported that CryptoBilis had not immediately responded to its requests for comment.
CoinDesk also reported separate suspected-implant discoveries involving a Ledger device bought at Singapore Airport and a report in Germany. These were separate investigations, not evidence that the devices were connected to the CryptoBilis-linked thefts.
Ledger said it was reviewing reseller controls, anti-tamper protections, and chain-of-custody practices. Those safeguards matter because a hardware wallet’s security depends on more than its design. Manufacturing, distribution, custody, and setup all play a part.
Key questions and answers
-
What should CryptoBilis buyers do?
Do not initialize an unused device. If you already used one, follow Ledger’s advice and move your assets to a wallet with a newly generated recovery phrase. Create it on a trusted, uncompromised device.
-
How much crypto was lost?
On-chain researchers estimated losses of about $86 million to as much as $93.2 million across more than 300 wallets. Ledger did not confirm a final total.
-
Was Ledger itself hacked?
Ledger said it had no indication that its internal systems, services, or direct sales channels were compromised. The reported cases tied to the draining incident involved devices distributed through CryptoBilis.
-
Does the $10 million USDT freeze mean victims got their funds back?
No. CoinDesk reported that Tether froze $10 million in USDT linked to the theft, but the available information does not establish that the funds were returned.
-
Are all Ledger devices unsafe?
The available reporting does not show that all Ledger devices, or devices from other manufacturers, were affected. It concerns particular devices and distribution channels, and the full scope remains unknown.
The lesson is not that hardware wallets are pointless. Wallet security depends on the journey from manufacture to setup, as well as on keeping the recovery phrase secret. An isolated signing chip is only one link in that chain.
Ledger’s warning was specific to devices bought through CryptoBilis.
