Ledger has published its clearest account yet of the CryptoBilis case. The company says criminals obtained genuine Ledger devices, opened and modified them after they had left Ledger's control, and then returned them to circulation through resellers in Southeast Asia. Ledger describes the incident as a localized distribution attack, not a compromise of its chip, operating system, servers or wider product fleet.
Key developments
- The affected units began as genuine Ledger devices but were physically altered after leaving Ledger's control.
- The hidden hardware was designed to capture a recovery phrase during initial setup.
- Ledger says its Secure Element, operating system, infrastructure and services were not breached.
- Spot checks in several markets and warehouse inspections found the examined stock to be clean.
- Ledger has introduced stricter handling rules across its authorized distribution network.
What Ledger has now confirmed
Ledger says an organized criminal group purchased genuine devices over a period of months. The units were opened, fitted with concealed electronic components and placed back into distribution through resellers in Southeast Asia. The group also prepared servers to collect captured information and infrastructure to move and launder stolen assets.
This matters because the devices did not begin as counterfeits. They were genuine products that were physically altered later. In practical terms, the case concerns custody and handling after the products left the manufacturer's control.
Ledger's classification of the incident
Ledger calls this a localized distribution attack. The company says the available evidence does not indicate a systemic compromise of Ledger products or services.
How the implanted hardware was intended to work
According to Ledger, the concealed component was designed to capture a user's recovery phrase during device setup. A recovery phrase is the master secret that controls the wallet. Anyone who obtains it can recreate the wallet elsewhere and move its assets without possessing the original device.
The company has not yet released the complete technical disclosure. Ledger says its Donjon security team analyzed the implant and that further technical information will be published when doing so no longer interferes with the investigation. Until then, claims about the exact circuit design, affected serial numbers or total number of altered units should not be treated as confirmed unless Ledger or investigators publish them.
The central risk is the recovery phrase. A replacement device does not solve the problem if the same potentially exposed phrase is restored. A clean migration requires a newly generated recovery phrase and new receiving addresses.
What was not compromised
Ledger states that the incident did not result from a flaw in its Secure Element, operating system or backend systems. Its servers and services were not breached. The confirmed attack took place after genuine products had left the company's control and involved adding unauthorized hardware before the devices reached end users.
| Question | Latest confirmed position |
|---|---|
| Were genuine devices involved? | Yes. Ledger says genuine devices were later opened and altered. |
| Was Ledger's chip or operating system breached? | Ledger says no. |
| Were Ledger's servers compromised? | Ledger says no. |
| Was the attack global? | Ledger describes it as localized and connected to distribution in Southeast Asia. |
| Has the full technical report been published? | Not yet. A fuller disclosure is planned after the investigation allows it. |
What Ledger checked after the reports
Ledger says it worked with law enforcement and the security community, examined the recovered implant and screened stock. Its teams also bought and opened devices from markets including Germany and inspected warehouse samples. Every unit examined through those checks was reported as clean.
Ledger also asked authorized resellers and distributors to suspend sales in Southeast Asia and Hong Kong while checks were carried out. The company's statement says the Ledger stock it screened showed no compromised units. These findings help define the known scope, but they do not replace case-by-case caution for people who purchased from CryptoBilis.
New rules for Ledger's authorized network
Ledger says the following controls now apply across its authorized reseller and distributor network:
- Returned devices must not be resold, even when they appear unused or unopened.
- Products should no longer be placed on open shelves or used as display stock.
- Inventory should remain in a controlled back-of-store area and be handed to the customer at purchase.
- Any unusual packaging, device behavior or customer report must be escalated promptly.
Ledger says it is also developing further product-level anti-tampering measures. Those measures have not yet been detailed publicly.
What users should do now
If you bought from CryptoBilis
- Not set up yet: do not initialize the device. Contact Ledger Support through the official website.
- Already set up: follow Ledger's guidance and move assets to a new genuine device using a completely new recovery phrase.
- Do not mail the device to anyone until Ledger Support has confirmed the next step through an official channel.
- Keep the device, packaging, receipt, transaction records and photographs as evidence.
If you bought elsewhere
- Check the seller and retain proof of purchase.
- Inspect the packaging, enclosure, seams, USB port and accessories before setup.
- Install Ledger's application only from Ledger's official website or a verified app-store listing.
- Run Genuine Check before transferring funds.
- Create the PIN and recovery phrase yourself on the device. Never use a phrase supplied in the box or by a seller.
- Start with a small test transfer and verify the full address on the hardware screen.
What this means for SIAMBC customers in Thailand
No evidence currently links SIAMBC-supplied units to the confirmed CryptoBilis incident
SIAMBC does not source Ledger devices from CryptoBilis. Ledger products supplied by SIAMBC come through an official channel. Once received, stock is kept in a locked, restricted-access area, stock movements are recorded, and products remain sealed until fulfilment.
SIAMBC is continuing to review upstream handling and storage controls with the relevant distributor. This is a precautionary verification of the chain of custody, not evidence that SIAMBC stock was affected.
Customers should still follow normal first-use checks. A new device should never arrive with a PIN already set, a recovery phrase already written down or instructions asking the customer to enter the phrase into a website, computer or support form. Stop immediately and contact official support if any of those signs appear.
Ledger and SIAMBC will never ask for your recovery phrase, PIN or private key. Anyone asking for those details should be treated as a scammer.
Frequently asked questions
Was Ledger hacked?
The latest statement does not describe a breach of Ledger's chip, operating system or servers. It describes genuine devices being modified after leaving Ledger's control and then reintroduced through a localized distribution route.
Does a successful Genuine Check prove that a device has never been opened?
Genuine Check verifies important cryptographic properties, but it should be combined with a trusted source, physical inspection and a clean setup. The CryptoBilis case shows why no single check should carry the entire burden.
Are all Ledger devices in Southeast Asia affected?
No evidence supports that conclusion. Ledger reports that screened stock and the units it spot-checked were clean. The confirmed case remains associated with the CryptoBilis investigation.
Should I restore my old recovery phrase on a replacement device?
Not if there is a possibility that the phrase was exposed. Generate a new phrase on a trusted device and transfer assets to new addresses.
Where should I follow future updates?
Use Ledger's official website and verified support channels. Be cautious with direct messages, copied support accounts and links posted under news updates.
Conclusion
The latest findings make the attack mechanism clearer: criminals modified genuine devices after they had left Ledger's control and attempted to capture recovery phrases during setup. That is serious, but it is not the same as a universal vulnerability in every Ledger device. The practical response is to separate confirmed facts from speculation, follow Ledger's instructions if CryptoBilis was the seller, and treat source verification and first-time setup as part of the security model.
Sources
Written by Bank · Updated 16 October 2026. This article reflects information available at the time of publication and may be updated as Ledger or investigators release further findings.
Share:
Ledger Atom Explained: An Android Security Device That Is Not a Phone
Trezor Reduces Reseller Network After Supply-Chain Scare