Ledger Confirms Chip in CryptoBilis Wallets Stole 24-Word Recovery Phrases

Ledger Explains the Screen-Reading Chip

Ledger has confirmed how a rogue component hidden inside affected hardware wallets managed to siphon recovery phrases. In an Oct. 13 update, the company's Donjon security team described an unauthorized part that sits inside the enclosure and reads the data shown on the screen. When a buyer initializes the device, the display presents the 24-word recovery phrase, and the implant's microcontroller decodes those words and transmits them over an LTE mobile connection using a pre-configured eSIM. The add-on leaves the Secure Element, the chip that stores private keys, and the device's operating system untouched, and it does not alter transactions or signatures. Ledger linked every confirmed fund loss from the Oct. 9 disclosure to devices sold by CryptoBilis, a reseller in Southeast Asia, and said it has not verified a drain tied to a signer bought anywhere else. The company has not confirmed how many users were affected or the total sum lost, noting that figures circulating online come from third parties.

@Ledger · X post

Oct. 13 update.

View on X

Fallout Spreads Through the Distribution Chain

The consequences are reaching well beyond the tampered units themselves. Blockchain investigators have published loss estimates above $86 million, with some analyses running past $90 million, but Ledger has not verified any of those totals and its own case count remains open. The company says it is working with authorities, contacting affected users, and has no indication that its infrastructure, systems or direct sales channels were compromised. CEO Pascal Gauthier wrote that the investigation is still trying to establish who tampered with the signers and where in the distribution chain it happened, calling physical supply-chain tampering “a risk for the whole industry.” The reseller's standing also shifted. OneKey, another wallet maker, revoked CryptoBilis's reseller authorization on Oct. 13. In a statement shared on LinkedIn, former CryptoBilis founders Vimalatheethan and Arravind Prabu denied any link to the incident, saying a change of ownership in March put the company outside their control. Binance co-founder Changpeng Zhao questioned parts of the reporting, suggesting hackers may have taken over CryptoBilis and used a non-disclosure agreement to keep it silent.

@_pgauthier · X post

Wrote.

View on X

Tibane Labs and Buyer Guidance

Instructions from Ledger now cover two groups of buyers. Anyone who purchased a device from CryptoBilis and has not yet initialized it is told to leave it untouched and contact support first. Owners who already set a device up should move assets to a new signer with a freshly generated phrase; migrating funds to another address derived from the same phrase would leave an attacker's access intact, a distinction our guide to seed phrase storage explains in detail. Ledger also published instructions for opening a device and inspecting its interior, warning that disassembly can damage the hardware, and said the Donjon team will examine devices it receives and share further findings. Owners of a suspect unit should speak to Ledger support or the police before shipping it anywhere. An earlier finding belongs in the record too: Tibane Labs, an independent investigation team, had previously reported the same screen-reading design in a Ledger Nano X bought outside the CryptoBilis channel, though it could not connect that device to the confirmed losses. CryptoBilis has stopped selling Ledger devices while the inquiry continues. A crypto wallet's protection model depends on the phrase never leaving the device, which is why setup, not everyday signing, was the moment of exposure.

The Narrow Confirmed Record

What stands out in the verified record is how small it still is: one physically examined device with an implant, one sales channel, and a case count Ledger has not finalized. Independent totals above $86 million rest on address clustering that can shift as analysts reattribute transfers, so any figure should carry a method and a timestamp with it. The mechanism also redraws a boundary many buyers assumed was closed: because the implant sits outside the Secure Element and outside every authenticity check that covers firmware, the phrase was exposed at the instant it was displayed. Skepticism about unverified numbers is fair, but it slides into FUD when it blurs confirmed cases with estimates. Verified serial ranges and a full forensic report are the disclosures worth watching next.