Ledger Confirms Hardware Implant in Devices Distributed by CryptoBilis Reseller

Ledger has confirmed that some of its hardware devices distributed through the Southeast Asian reseller CryptoBilis were compromised with a spy implant that drained users' cryptocurrency wallets. The implant was installed during the distribution process and was designed to exfiltrate private keys or seed phrases upon device setup or firmware interaction. The breach was discovered after users reported unauthorized cryptocurrency transactions. Ledger stated that the affected devices were distributed prior to the discovery of the compromise. The company has not released a firmware patch for the implant, as the compromise is hardware-level, and has advised affected users to assume their devices are compromised, discard the hardware, and generate new seed phrases on new, verified hardware. The reseller CryptoBilis operates in Southeast Asia, and the full scope of affected users and the extent of financial losses remain under investigation. Security researchers note that hardware implants in the supply chain are technically feasible but difficult to verify without physical inspection. The incident underscores the risks of purchasing hardware wallets from unofficial or unauthorized resellers.