Ledger CTO Charles Guillemet States Team is Focused on CryptoBilis Incident
Ledger CTO Charles Guillemet stated that the team is focused on the CryptoBilis incident. If you purchased a Ledger signer from CryptoBilis and have not set it up, do not set it up; if it is already set up, please transfer your assets to a new signer with a new recovery phrase as soon as possible. Ledger will never proactively call, message directly, or request a 24-word recovery phrase.
If you hold a tampered signer, please contact Ledger support before sending it. The company wants to inspect these devices, and the support team will provide shipping instructions. If you have lost funds, please report to local law enforcement first, and only open or send the signer after coordinating with them.
Ledger is reviewing dealer control and anti-tampering protection measures. The company invites researchers and other vendors to collaborate on improving tamper detection and supply chain practices. If you did not purchase from CryptoBilis and wish to inspect the internals of your signer, you can refer to the official guidelines, but proceed with caution and back up your recovery phrase first, as opening the device may cause damage.
Guillemet emphasized that some statements and numbers circulating online have not been verified. Scammers often try to exploit such incidents. Users should rely only on official Ledger channels for updates. This statement complements the CEO's earlier information about the ongoing investigation, confirming hardware implants, and that only signers sold through CryptoBilis are affected.
The company is collecting devices through official support channels for inspection by the Donjon team, while asking users to prioritize coordination with law enforcement. Funds are being transferred from users with affected devices that have been set up to new devices, benefiting those who can transfer assets in a timely manner, while those who do not act promptly or fall victim to subsequent scams bear the burden.
Source: Public Information
ABAB AI Insight
As Ledger's CTO, Charles Guillemet issued operational guidelines within days of the incident, emphasizing that unactivated devices should not be activated, and assets from activated devices should be transferred immediately, clearly stating that the company will not request recovery phrases. This guidance aligns with CEO Pascal Gauthier's statement, which limits confirmed issues to signers sold through CryptoBilis and points to physical tampering in the supply chain rather than a breach of the company's systems.
On the capital path, the company is receiving tampered devices through official support channels for analysis by the Donjon team, while requiring users who have suffered losses to report to law enforcement first. They are reviewing dealer control and anti-tampering measures and publicly inviting external researchers and vendors to participate in supply chain improvements. Users are directed to official guidelines to check their devices but must back up their phrases first to avoid damage risks.
This is similar to user operation and evidence preservation guidelines issued by manufacturers after confirming supply chain issues in other hardware security incidents. Currently, the company is in a phase of investigation and evidence collection, attempting to protect user assets while obtaining physical evidence to determine tampering points.
This essentially belongs to the reconstruction of the industrial chain. Physical implants make distribution nodes an attack surface, and manufacturers are reconstructing the trust chain by strengthening dealer reviews and anti-tampering mechanisms. The mechanism separates user asset transfers from device evidence collection, avoiding users directly handling potentially damaged devices, while controlling information flow through official channels to reduce secondary scams.
ABAB News · Cognitive Law
Unactivated devices preserve evidence; activated devices should prioritize transfer
Official channels control information; external numbers are often noise
Supply chain reviews fill gaps; physical evidence determines responsibility boundaries