POPA ReconLedger and CryptoBilis implant investigation
Ledger confirmed that one impacted user’s device contained an unauthorized hardware implant. Ledger has not said what the implant did or established that it caused the reported fund losses; it says there is no indication its security infrastructure, systems or services were compromised. CryptoBilis confirmed it stopped sales of all hardware wallet inventory while the investigation continues. Ledger’s update · The Defiant’s report
What users should do
Ledger says CryptoBilis customers who have not set up their device should not start setup. Those who have set it up should consider moving assets to a new Ledger signer with a new seed. Ledger says it is contacting impacted users and advises relying on its official channels; it will never ask for a 24-word recovery phrase. Contact Ledger Support for assistance. CryptoBilis’s two management notices are titled Update and Official Notice, but their accessible text does not provide further user steps. The sources do not establish the implant’s function or its connection to the losses.