Ledger says an organized group spent months buying genuine devices, implanting hardware to steal recovery phrases, and reselling them through Southeast Asian channels. It says the implant reads the setup screen and sends the displayed 24-word phrase over LTE; the company’s October 13 update said all then-confirmed losses involved devices sold through CryptoBilis, with no verified drain tied to devices bought elsewhere (Ledger’s technical update).

Ledger says an organized group spent months buying genuine devices, implanting hardware to steal recovery phrases, and reselling them through Southeast Asian channels. It says the implant reads the setup screen and sends the displayed 24-word phrase over LTE; the company’s October 13 update said all then-confirmed losses involved devices sold through CryptoBilis, with no verified drain tied to devices bought elsewhere (Ledger’s technical update).

Ledger says the implant does not alter the Secure Element, its operating system, transactions, or signatures. Its October 15 response says its internal infrastructure was not compromised; its Genuine Check can still pass when the original Secure Element remains intact, according to The Defiant (Ledger’s response, The Defiant).

Ledger told authorized resellers to keep products off displays, store them out of sight until purchase, report unusual-device complaints promptly, and never resell returned devices. The supplied report also attributes a multi-million-dollar interception and laundering infrastructure to the attackers, but Ledger’s cited updates do not substantiate that amount (WuBlockchain’s report).