Ledger: a hardware implant that reads the seed from the screen found in signing devices from reseller CryptoBilis; thefts of funds confirmed

Ledger Donjon is investigating Ledger signing devices sold by reseller CryptoBilis in Southeast Asia: an unauthorized hardware implant was found inside the casing. The vendor confirmed the finding on October 10 in a device belonging to one victim. The implant reads data displayed on the screen and, when the 24 words of the recovery phrase are shown during initial setup, decodes them with a microcontroller and transmits them over LTE through a built-in eSIM. It is a separate component: the device's Secure Element and operating system are unchanged, and transactions and signatures are not substituted. All confirmed losses of funds associated with the October 9 incident involve signing devices purchased through this reseller; the vendor has not confirmed any theft from a device bought elsewhere. The reseller said it had stopped selling Ledger signing devices for the duration of the investigation. The vendor has not confirmed the total number of victims or the amount lost; the figures circulating online come from third parties and have not been fully verified. The vendor is also investigating reports of implants in other devices and regions. There is no patch here, and there cannot be one: this is physical tampering with the device, and an exposed recovery phrase remains compromised.