A hidden hardware implant in Ledger devices has sparked global distrust, with users fearing their crypto wallets may have been compromised during sales.
Security flaw revealed in Ledger devices
A hidden hardware implant was discovered in Ledger devices sold by CryptoBilis, a Southeast Asian reseller, which allowed the theft of users' cryptocurrency recovery phrases. This flaw was confirmed by Ledger’s security team, Donjon, after analyzing a user’s device.Hidden implant steals recovery data
The implant, found in the casing of the device, captured the 24-word recovery phrase displayed during setup and transmitted it remotely via LTE and an eSIM. This allowed hackers to access and empty users’ cryptocurrency accounts.Suspicion extends beyond one reseller
While Ledger has confirmed that all known losses are linked to devices from CryptoBilis, users are raising concerns that the issue might affect other resellers and retailers, including MediaMarkt and Saturn in Europe. Some users have reported finding similar modifications in devices bought from these stores.Users demand transparency and recalls
Johannes, a user who discovered modified devices in two different stores, called for a product recall, claiming that the modifications could indicate a broader issue. Ledger has not confirmed these claims, but users are demanding detailed reports and clearer assurances about device security.Ledger promises improved controls
Charles Guillemet, technical director of Ledger, stated the company is reviewing its reseller controls and anti-counterfeiting measures. However, users are waiting for a detailed report on the CryptoBilis incident, including the number of victims and the amount of losses.
