Ledger signer risk and what affected buyers should do.

Ledger signer risk and what affected buyers should do

Ledger says an unauthorized implant in signers sold through CryptoBilis can read the screen during setup, decode the displayed 24-word recovery phrase, and transmit it over LTE. A phrase exposed this way could let someone take control of the associated wallets. Ledger says the implant is separate from the Secure Element and operating system and does not alter transactions or signatures. It has not verified a drain linked to a signer bought elsewhere, and the total number of affected users and losses remains unconfirmed. Ledger’s October 13 update · The Defiant’s report

What to do

If you bought a signer from CryptoBilis and have not set it up, do not set it up. Contact Ledger Support. If you already set it up, promptly move assets to a new signer initialized with a newly generated recovery phrase. Never enter or restore a recovery phrase on the CryptoBilis device, or type it into a website, app, or form. If funds were lost or you have a suspected tampered signer, contact Ledger Support and local law enforcement before sending or opening the device. Ledger says it will never call or message you to ask for your phrase. Ledger’s guidance

Ledger’s investigation update « · » Ledger Support « · » The Defiant report