Ledger confirms unauthorized implants on affected devices

Core Points

Ledger found an unauthorized hardware implant in the affected equipment. The company has not disclosed the number of equipment that may be affected. CryptoBilis has suspended sales of its hardware wallet inventory. Ledger said it found no evidence of damage to its systems or services. Buyers who have already set up equipment should consider transferring funds to new signers who use new mnemonics. Ledger has obtained a confirmed physical clue.

Physical clues that Ledger obtains confirmation

In its latest public update, Ledger stated that a device owned by an affected user contained an unauthorized hardware implant. The company is contacting affected users, working with distributor CryptoBilis, and collaborating with relevant authorities. Ledger also said it found no signs of damage to its security infrastructure, systems or services. The discovery drew attention to the distribution channels of the equipment, as the company continued to investigate the broader circumstances of reporting losses.

It has been confirmed that one of the affected equipment contained implants

Ledger found unauthorized physical modifications in equipment associated with the report of loss of funds. Still under review: How much equipment was affected and what role did the implant play? Ledger has not disclosed the potential scope or publicly linked the implant to every reported loss of funds.

How did the case develop to this point

Ledger 在用户报告与通过 CryptoBillis 购买的设备相关的资金丢失后开始进行调查。当时，该公司尚未确认共同原因、报告的总损失金额或其自身系统是否受到损害。它要求经销商暂停销售，并警告客户不要初始化未使用的设备。早期的报告和 Ledger 的初步指导详见此处（原文链接已隐去）。最新的声明为调查提供了具体的设备层面发现。它并未确定可能受影响的单位数量，也未解释每起报告的资金丢失是如何发生的。

CryptoBillis 已停止销售硬件钱包

Ledger 表示，CryptoBillis 已停止所有硬件钱包库存的销售，直到调查结束。这一暂停限制了通过经销商的进一步分销，同时两家公司确定下一步措施。这一发现将重点放在供应链上。硬件钱包的安全性始于所有者创建钱包之前：设备必须在没有未经授权修改的情况下送达给它们。Ledger 并未表示每个 CryptoBillis 设备都被篡改，这就是为什么调查和销售暂停仍然重要的原因。（“阅读更多”链接及图片链接已隐去）卢森堡计划发行欧洲首个基于区块链的主权债券（标题保留，正文无关部分略过）。

社交媒体列表不应被视为确证

A post on X (formerly Twitter) by CryptoQuant contributor Darkfost listed other Ledger dealers in Southeast Asia, saying they may face supply chain risks due to their regional proximity to CryptoBilis. The post made it clear that the claims were speculative and did not provide evidence that the retailers sold tampered with devices. (Image link has been hidden) Ledger has confirmed the presence of an unauthorized implant in a device related to CryptoBilis. It has not publicly identified other dealers, identified broader distribution issues, or advised all customers in the region to move funds. Therefore, buyers should avoid viewing circulated dealer lists as official warnings, and should follow Ledger's guidance if purchasing from CryptoBilis or receiving direct updates from the company.

Things to Consider by Affected Buyers

The following steps apply to people purchasing Ledger equipment through CryptoBilis. Ledger has not issued migration instructions to all Ledger users.

• Leave unused equipment uninitialized: Customers who purchased from a dealer and have not yet started setting up should not initialize the equipment during the investigation.
• Don't reuse existing recovery phrases on replacement devices: A replacement device that loads the old 24-word phrase will restore the same wallet. It will not create independent security boundaries.
• Consider transferring assets to new signers using new phrases: For previously initialized devices, Ledger recommends considering migrating to brand new wallet settings. The user should verify each destination address on the hardware wallet screen before approving the transaction.
• Do not reveal recovery phrases: Ledger means that users will never be asked for their 24-word recovery phrases. Any request for this should be considered an attempt at fraud.

Investigation now has physical clues

Ledger's confirmation transformed the case from a series of user reports to an investigation with confirmation device-level findings. Questions remain about the scale of the problem and the link between the implant and the reported loss of funding. For CryptoBilis buyers, the priority is simple: Don't initialize unused equipment, and use a new recovery phrase if you decide to move assets. For other self-managed users, the incident is a reminder that wallet security depends on the integrity of the device before signing the first transaction.

This article is for informational purposes only and does not constitute financial or security advice. Users who believe their equipment may be affected should follow Ledger's official instructions and never share their recovery phrases. (The copyright and source information of the article have been concealed)