Overview
- Public reports of drained wallets tied to devices sold by Southeast Asian reseller CryptoBilis surfaced on October 9, prompting Ledger to open an investigation that led to confirmation of hidden LTE/eSIM implants.
- Ledger’s Donjon team says the implant reads the 24‑word recovery phrase from the device screen during initial setup and transmits it over a cellular link, which lets attackers restore and empty wallets without touching Ledger’s Secure Element.
- Blockchain investigators estimate roughly $86 million to $90 million in suspected thefts across multiple chains but Ledger says those totals remain unverified as its probe and law‑enforcement coordination continue.
- Chainalysis traced a separate theft of about 60 BTC (roughly $4.8–$4.9 million) that was moved into Ledger addresses and emptied on October 9, illustrating how on‑chain tracing is linking specific losses to the compromise.
- Ledger has told buyers who set up CryptoBilis devices in the past 90 days to move funds to new hardware with a new recovery phrase, many regional resellers have paused sales, and the industry is tightening distribution checks while warning users against panic‑driven scams that ask for seed phrases.