Ledger CEO Pascal Gauthier announced on October 13 that the company was reviewing its direct-sales and reseller controls, chain-of-custody practices and tamper detection after Ledger confirmed an unauthorized implant in one signer sold through CryptoBilis. Gauthier also invited researchers and other vendors to collaborate on those safeguards. Ledger’s investigation update and Gauthier’s announcement describe an ongoing review.
What Ledger says the implant did
Ledger said its security team, Ledger Donjon, found a separate component that read the 24-word recovery phrase displayed on the signer’s screen during setup, decoded the words and sent them over LTE using a provisioned eSIM. Ledger said the component did not modify the Secure Element, the device’s operating system, transactions or signatures. Ledger’s October 13 update describes one confirmed affected signer; it does not identify that signer’s model.
As of that update, Ledger said all losses it had linked to the incident involved signers sold through CryptoBilis, a reseller in Southeast Asia. The company had not verified a drain linked to a signer bought elsewhere, and had not confirmed the total losses or number of affected users.
What CryptoBilis buyers should do
Ledger’s instructions depend on whether the signer has been set up:
- If it is unused, do not initialize it.
- If it has been set up, promptly move the assets to a new signer with a new recovery phrase.
- Do not enter or restore a recovery phrase on a CryptoBilis signer.
- Before sending a suspect signer to anyone, speak with Ledger Support or local law enforcement. If funds were lost, coordinate with law enforcement before opening the device.
In a screenshot attached to Ledger’s October 11 update, the company’s Malaysia reseller directory listed CryptoBilis as “Sales temporarily paused.” Ledger’s update includes that directory screenshot.
