The CryptoBilis investigation found a component that reads a device’s screen and sends recovery words over a mobile network. The sales suspension request now covers other resellers in the region.
Ledger has asked resellers and distributors in six Southeast Asian countries and Hong Kong to stop selling its devices and remove them from shelves. The announcement, posted late on October 13 UTC, names Indonesia, Singapore, Thailand, the Philippines, Vietnam and Malaysia. The request follows the discovery of unauthorized hardware inside devices sold through CryptoBilis.
Ledger’s initial October 9 warning focused on CryptoBilis customers. The latest notice expands the sales precaution, while the company says confirmed loss incidents remain confined to Southeast Asia. It has not established who altered the devices or where in the distribution chain the tampering occurred.
Ledger’s official announcement on Asian reseller sales
The post loads from X when you open it.
The added component reads recovery words from the screen
According to findings published on October 13 by Ledger’s Donjon security team, an added microcontroller decodes the 24 words shown during initial setup from display data. It then transmits them over LTE using an eSIM. Ledger says the implant does not modify the Secure Element security chip or Ledger OS.
A recovery phrase allows account keys to be recreated in a compatible wallet. If those words are exposed, keeping the physical device does not prevent someone else from accessing the same accounts. Changing the device PIN does not invalidate exposed recovery words. Accounts protected by an additional passphrase also require that secret.
Ledger’s hardware integrity documentation, updated October 14, explains the limit of its genuine check: it authenticates the security chip. A spy component added without altering the original chip can escape that check. The support document also warns that opening a device can cause permanent damage and void its warranty.
The $102 million figure comes from an onchain investigation
In its October 13 investigation, Bitquery calculates that $102 million left 324 wallets across six networks. The valuation uses October 9 prices and excludes swaps and transfers between the attacker’s own accounts from the loss total. The wallet count is not a count of individual victims.
Ledger has not verified the overall loss. Transaction records alone cannot establish how each account’s keys were obtained or identify the physical device involved.
CryptoBilis buyers are advised to use a new device and new words
Ledger tells CryptoBilis buyers who have not initialized their devices to leave them unused. Those who already completed setup are advised to move assets to accounts created with a new recovery phrase on a new device. Restoring the old words on different hardware does not replace exposed keys.
Do not enter recovery words into a support form. Ledger says the words should never be entered into a website, app or form. Users with suspected tampering should contact official support before dismantling or shipping a device.
