Ledger has confirmed that some of its hardware wallets sold through Southeast Asian reseller CryptoBilis were modified with hidden hardware implants that stole cryptocurrency from users.
The company began investigating reports of missing funds on October 9 and asked CryptoBilis to stop selling and shipping Ledger devices. A day later, Ledger confirmed that at least one affected device contained an unauthorized hardware implant.
Researchers found that the implants were hidden inside Ledger X devices and could capture information from the screen and button presses. According to researchers, the devices could use the information to steal users’ recovery phrases and send them to attackers through a mobile network connection.
Cryptocurrency researcher Mark Karpelès and security researchers at Tibane Labs discovered two versions of the malicious hardware. The implants were designed to fit inside the wallets, with some components hidden behind the screen or placed near the battery.
Ledger said all reports of unexpected cryptocurrency losses investigated so far were linked to devices sold through CryptoBilis. The company described the number of affected users as limited and said it was working with authorities to identify those responsible.
Ledger has warned customers who purchased devices through the reseller not to set them up if they have not already done so. Users who have already set up an affected device are advised to move their funds to a new hardware wallet using a new recovery phrase.
The company also urged customers to buy devices only through authorized sellers and reminded its distributors not to resell returned products.