Ledger confirms hardware implant in CryptoBilis devices, with seed phrases exfiltrated via LTE.

BlockBeats news, October 13: The Ledger security team released the latest investigation progress on the hardware implant incident, confirming that some Ledger hardware wallets sold by Southeast Asian distributor CryptoBilis were implanted with unauthorized hardware. The implant is located inside the device casing and can read the screen display content, intercepting the 24 mnemonic words during user initialization, and exfiltrating them via LTE network through a built-in microcontroller paired with an eSIM. This component operates independently without modifying the Secure Element or Ledger operating system, nor does it interfere with transaction signing. As of now, in the fund theft incident disclosed on October 9, all confirmed losses are related to devices from the CryptoBilis channel, while other channels have not yet verified related cases. CryptoBilis has suspended sales of Ledger products, and the investigation is ongoing.

Ledger stated that it has not yet confirmed the total number of affected users and the amount of losses, and figures circulating online have not been officially verified. The company advises users who purchased uninitialized devices from CryptoBilis not to set them up, and those who have already set them up should immediately transfer assets to a new device and generate a completely new mnemonic phrase, and must not restore the mnemonic phrase on the affected device. Affected users are requested to contact Ledger's official support channels and report to local law enforcement. Ledger emphasized that its official channels and directly sold products are unaffected, reminding users to purchase only through authorized channels and to be vigilant against any requests for mnemonic phrases.