Security
Ledger wallets sold by a reseller were tampered with
Ledger wallets bought from a reseller were tampered with. Here's the timeline, with what's confirmed and what isn't.
9 Oct: Ledger opened an investigation and asked CryptoBilis to pause sales and shipments.
10–13 Oct: Ledger confirmed hidden implants in devices sold through CryptoBilis, a Malaysia-based reseller.
The implant reads your recovery phrase during setup and sends it over a cellular connection.
Ledger hasn't confirmed a total loss, and says the number of affected devices is “limited.” Third-party estimates have been reported, but none are confirmed.
Ledger's warning: if you bought a signer from CryptoBilis and haven't set it up, don't set it up, and contact Ledger Support. Ledger will never ask for your recovery phrase.
Source: Ledger statements, third-party analysts
