The investigation into crypto thefts linked to hardware wallets sold through Southeast Asian reseller CryptoBilis has exposed a limit in device authenticity checks: a genuine security chip can remain inside a physically modified enclosure. Buyers can therefore face a compromised setup process even when the chip itself passes authentication.
Ledger's security team described an unauthorized implant on October 13, following its earlier confirmation of an implant in one victim's device. Blockchain investigator Bitquery's dated investigation records that explanation and separately estimates $102 million taken from 324 wallets across six chains. Those are the investigator's figures, not a loss total confirmed by Ledger.
The setup screen became the point of exposure
According to the Ledger account recorded in Bitquery's investigation, the implant captured the recovery words displayed during initialization and transmitted them over a mobile network. It did not need to replace the original security chip or change the device's transaction signatures.
The distinction is material. An attacker who obtains usable recovery material can recreate spending authority elsewhere. They need not return to the buyer's device each time they want to move assets. Locking that device afterward does not make an already disclosed secret private again.
The BIP39 recovery standard explains how mnemonic words are converted into a seed. It supports the underlying distinction between the physical signer and the recovery material. Compatibility and any additional passphrase still matter; the words should not be treated as an ordinary login password.
What a genuine-device check can establish
Ledger's own Donjon threat model explicitly says its Genuine Check cannot detect unauthorized physical modifications, including spying implants, when the original Secure Element remains intact. The check authenticates that chip through a signed challenge and attestation.
This means a successful chip authentication is narrower than a verified history of everything inside the enclosure. The official documentation also warns that conventional tamper seals can create false confidence because packaging can be opened or seals copied. Neither a familiar box nor a valid chip response establishes an uninterrupted physical supply chain.
The loss estimate and the cause have different evidence
Bitquery labels its on-chain figures as verified on October 13 and values the theft at October 9 prices. The valuation date matters: the estimate measures a past theft, rather than repricing the stolen assets at the moment a reader opens the report. Counting wallets is also different from counting people or physical devices.
Transaction tracing does not by itself prove how each victim's recovery material escaped. A hardware finding in one device and a set of related outgoing transfers answer different questions. It would be premature to claim that every wallet in the investigator's tally has been forensically tied to an identical implant.
That leaves the extent of physical tampering and the total number of affected devices unresolved. The dated dollar estimate is also not a live measure of funds still recoverable. This report does not equate money traced on a blockchain with money returned to victims.
Our guide to keys, backups and recovery explains the consequence of a disclosed backup: restoring the same wallet on another device preserves the same underlying authority. It does not revoke an attacker's copy. The investigation makes acquisition and initialization part of the custody question, alongside signing and backup storage.
The investigation now turns on the physical supply chain: who handled the affected devices and where their integrity was lost.