Ledger is reviewing its sales policies and how its devices reach customers after the “Cryptobilis incident,” in which physical tampering along its supply chain led to $93 million in cryptocurrency theft from user wallets, according to a Bloomberg report on October 13. The crypto hardware manufacturer’s CTO, Charles Guillemet, confirmed in a social media post that it is also reviewing anti-tampering protection on its devices following the incident. He told users with tampered signers (hardware wallets) to contact Ledger support for shipping instructions to send the devices in for further examination. Guillemet also advised users who wanted to physically open their signers to check for tampering to review the company's guidelines on how to do so safely.
In a separate post, Ledger CEO Pascal Gauthier said, “Physical supply chain tampering is a risk for the whole industry. We are reviewing the controls that apply to our direct sales and to resellers, and we will share what we can,” confirming the company's plan to review its chain-of-custody and tamper detection practices. The company is inviting researchers and other vendors to collaborate in assessing these practices.
The incident that prompted the reviews was first noticed on Friday, October 9, when hundreds of otherwise secure wallets drained simultaneously across the Bitcoin, Ethereum, and Tron networks, triggering a massive alert across social media and blockchain security networks. Several victims came online to report losses and try to figure out what was happening. Early investigation revealed that almost all the affected wallets had been procured from CryptoBilis, an authorized third-party reseller covering Malaysia and Southeast Asia. Ledger ordered CryptoBilis to immediately halt all sales and shipments.
After further investigation, Ledger officially announced on October 10 that it had discovered a physical, unauthorized hardware implant equipped with a cellular/LTE module inside an affected user's device. It turns out that the attackers had manually installed the chips in brand-new devices at some point in the supply chain. When a new user is generating or verifying their 24-word recovery seed phrase on the wallet's screen during initial setup, the rogue chip records the OLED output or reads the raw hardware data lines carrying the text.
The integrated cellular chip then silently transmits the unencrypted recovery phrase over LTE networks directly to the attackers' external command servers, granting them full remote access to clone the private keys and drain the associated cryptocurrency funds. The hardware modification completely bypassed Ledger's standard automated “Genuine Check” software protocol, as it sat entirely outside the microchip running Ledger's standard firmware.
Ledger has stressed that its internal infrastructure, firmware code, and direct-to-consumer sales channels through Ledger's Official Store remain entirely uncompromised. The company has advised users with wallets from third-party resellers to transfer funds to a separate wallet secured by a freshly generated, uncompromised 24-word recovery phrase while it conducts further investigations. It is also restructuring its vendor verification and supply chain requirements, instructing distributors to enforce tighter tracking, source only through approved channels, and strictly ban the restocking or resale of returned units.