Ledger Donjon Spots a Sneaky Roommate Inside the Hardware 🕵️

Paris-based hardware wallet manufacturer Ledger confirmed that a device sold through Southeast Asian reseller CryptoBilis contained an unauthorized hardware implant capable of stealing users' recovery phrases. The implant, which Ledger Donjon, the company's internal security research team, confirmed on October 10 in one affected user's signer, sits inside the device's enclosure and reads data shown on the screen. When it detects the recovery phrase screens, its microcontroller decodes the 24-word words and transmits them over LTE using a provisioned eSIM, according to Ledger's analysis shared on Tuesday on X. The implant is a separate component, Ledger said, adding that it does not modify the device's Secure Element or the Ledger operating system, nor does it alter transactions or signatures.

Onchain investigator Specter has traced more than $86 million in suspected thefts across Bitcoin ($BTC), Ethereum ($ETH) and Tron tied to the incident, a figure Ledger said it has not independently verified. Ledger has not confirmed the total number of affected users or the total value of reported losses, and stated that all confirmed cases in last week's draining incident involve devices sold through reseller CryptoBilis, with its own systems and direct sales channels remaining unaffected. "The volume of impacted devices is limited," the company said in a 72-hour update on Sunday, adding that it is working to identify the scope of the compromise.

Ledger has asked CryptoBilis to pause all sales and shipments of Ledger devices as a precaution. "As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices," the company's support account wrote. CryptoBilis confirmed it had ceased sales of all hardware wallet inventory until the investigation is concluded, and Ledger said it is in active communication with the reseller on next steps. CryptoBilis was listed as an authorized Ledger reseller in Indonesia, Malaysia and the Philippines.

Ledger is recommending that users who purchased a device from CryptoBilis and have not yet set it up should not initiate setup. Users who have already set up their device should consider moving assets to a new Ledger signer generated with a new seed phrase. "Ledger's infrastructure, systems and services were not compromised," the company said in a statement, adding that the incident appeared to be isolated to the single reseller and its market. Ledger is also reviewing reports of implants in other signers and locations after an X user claimed to have found two tampered Ledger devices bought from retail stores in Europe, a claim that has not been independently verified.

The company is asking anyone with information regarding the investigation to contact its bounty program at bounty@ledger.fr. Users seeking assistance or with questions can contact Ledger customer support through official channels at support.ledger.com.