Ledger says one affected user’s device contained an unauthorized hardware implant. The company reported the finding on Oct. 10 and said it was contacting affected users as its investigation continued. It did not identify the device model in the post. Ledger Support’s Oct. 10 update.
In its Oct. 11 follow-up, Ledger said all confirmed cases tied to the draining incident it disclosed on Oct. 9 involved devices sold through Southeast Asian reseller CryptoBilis. The company described the number of impacted devices as limited, said its internal systems and direct sales channels were unaffected, and said it was working with relevant authorities. Ledger’s statement refers to cases it says it confirmed; it does not provide a device-by-device total.
For CryptoBilis buyers, Ledger gives device-specific guidance but has not said how or when the implant entered the affected device. The company tells buyers to leave unused devices uninitialized. If a device has already been set up, Ledger advises moving to a new seed on a device from Ledger, contacting support through official channels, and filing a report with local law enforcement.
Ledger also says it will not call, send a direct message, or ask a customer for a 24-word recovery phrase.
The featured image is an illustrative Ledger Nano S photo by Motokoka via Wikimedia Commons, shared under CC BY-SA 4.0 and adapted by cropping, resizing, and metadata removal; it is not evidence of the specific device Ledger investigated. The company has not identified the affected model or described the implant’s function.
Hardware security has a design-time layer too. Our report on Tenstorrent’s security and system-management models covers virtual modeling of security-related IP before physical silicon is ready. Ledger’s public statement instead focuses on a physical device and reseller-linked cases, without saying when or where the implant was introduced.
