Ledger CEO Pascal Gauthier: Investigation into CryptoBilis Incident Continues to Confirm Hardware Implantation
Ledger CEO Pascal Gauthier stated that the investigation into CryptoBilis is ongoing, with him and the executive team dedicating time and resources to protect users and identify malicious actors. The company only communicates verifiable facts through authorized channels. All confirmed financial losses related to the incident disclosed on October 9 involve Ledger signers sold through the Southeast Asian distributor CryptoBilis.
On October 10, Ledger confirmed that one affected signer contained unauthorized hardware implants. The company stated there is no evidence that its infrastructure, systems, or services were compromised. CryptoBilis has confirmed it has stopped selling Ledger signers. The investigation is still determining who tampered with these devices or at which point in the distribution chain it occurred.
The Donjon team will examine the received signers, and the Ledger support team is reviewing user reports. The company is contacting affected users and cooperating with law enforcement. If you purchased a signer from CryptoBilis and have not set it up, do not set it up; if you have set it up, please transfer your assets to a new signer with a new recovery phrase as soon as possible.
Do not send the signer to anyone, especially users who have lost funds, before communicating with Ledger support or local law enforcement. Ledger will never proactively call, message directly, or ask for a 24-word recovery phrase. Physical supply chain tampering is a risk across the industry. The company is reviewing controls between direct sales and distributors and is calling on researchers to collaborate with other manufacturers to improve regulatory chains and anti-tampering practices.
Third-party on-chain research estimates losses between $86 million and $102 million, involving over 300 wallets, but Ledger has not confirmed official figures. Some reports indicate that the implant could intercept screen data to capture seed phrases. Funds are flowing from affected users to attackers, with the beneficiaries being those who implemented the physical tampering, while the burden falls on users who purchased devices through that distributor.
Source: Public Information
ABAB AI Insight
As a hardware wallet manufacturer, Ledger has long emphasized security elements and authenticity verification. In this incident, all confirmed loss devices were sold through CryptoBilis, an authorized distributor operating in Indonesia, Malaysia, and the Philippines. The company confirmed that one device had unauthorized hardware implants but stated that its systems and direct sales channels were unaffected. Researchers, including former Mt. Gox CEO Mark Karpeles, disassembled related devices and found an additional circuit board with an LTE module behind the screen, capable of intercepting display data.
In terms of capital flow, attackers captured the recovery phrase displayed during the initial setup by implanting hardware in the distribution chain, thereby transferring assets. Third-party estimates of losses range from $86 million to $102 million, involving hundreds of wallets. Tether has frozen some related USDT. CryptoBilis has stopped sales, and Ledger is reviewing distributor controls and cooperating with law enforcement. Users are advised to transfer assets to new devices with new recovery phrases.
Similar historical cases include physical tampering incidents in the supply chains of other hardware wallets or electronic products, as well as attacks in the crypto space that obtain seeds through social engineering or malware. We are currently in a phase where trust in the supply chain is breached by physical means, and hardware integrity verification cannot detect additional circuits that do not compromise security elements.
This fundamentally represents a restructuring of the industry chain. Physical implants make the distribution stage an attack surface, bypassing the manufacturer’s systems and authenticity checks. The mechanism involves attackers controlling distributor inventory or logistics nodes, implanting devices within sealed packaging, capturing phrases remotely during user setup, and funds flowing from user wallets to addresses controlled by attackers.
ABAB News · Cognitive Law
The supply chain stage determines hardware trust, and implants bypass system protections.
Authenticity checks confirm chips but cannot detect additional circuits.
Once the recovery phrase is leaked, asset transfers cannot be reversed.