Overview
- Ledger confirmed that a limited batch of devices sold through Southeast Asian reseller CryptoBilis contained concealed LTE eSIM implants that read the 24‑word recovery phrase from the device screen during setup.
- Reports of drained wallets first became public on October 9, after on‑chain investigators traced coordinated outflows and Ledger began a Donjon‑led forensic probe of tampered units.
- Chainalysis traced a high‑profile case in which a 'task scam' operator lost roughly 60 BTC when three Ledger addresses were emptied and consolidated on October 9, showing how stolen recovery phrases were used to rebuild and move funds.
- Third‑party blockchain analysts estimate total drains in the roughly $86 million to $90 million range but Ledger says it has not verified those aggregate figures and investigations and law enforcement tracing are ongoing.
- Industry and user responses include CryptoBilis pausing shipments, Ledger asking resellers in Southeast Asia and Hong Kong to stop sales, retailers tightening reseller rules, and guidance that anyone who activated a CryptoBilis device in the past 90 days should treat it as compromised and move funds to a new seed on a trusted device.