Ledger’s implant investigation prompts reseller restrictions

Ledger’s investigation into altered hardware wallets sold by CryptoBilis has prompted restrictions across the reseller network. In an October 13 update, Ledger said its Donjon security team was investigating signers sold by the Southeast Asian reseller that contained an unauthorized hardware implant.

The official Ledger post says the company confirmed the implant in one affected user’s signer on October 10. It establishes a specific confirmed device, without settling the number of affected customers or the full extent of the incident.

Brian Danga’s October 13 report for The Block describes Ledger Donjon’s finding that an added component could read a recovery phrase displayed during setup and transmit it through an LTE connection. According to the report, Ledger said its Secure Element and operating system were not altered and that the implant did not modify transactions or signatures.

The report says Ledger found no indication that its own systems or services were compromised and asked CryptoBilis to pause sales and shipments. MediaMarktSaturn separately told The Block it had removed affected products from stores and online sales. Those responses concern the supply and handling of physical devices as the investigation continues.

OneKey has also changed its reseller controls. In an October 12 statement from the OneKey Team, the company said it had received no reports of OneKey users losing assets in connection with the incident, while revoking CryptoBilis’s authorization as a precaution.

OneKey said it had stopped adding resellers and would review every existing one again. It will revoke authorization where it cannot verify a reseller’s business entity or identify its ultimate beneficial owner. A complete authorized list is planned after the review.

The company also offered free replacements for eligible OneKey devices bought from CryptoBilis between March 1 and October 12. These measures do not establish that OneKey devices contained the same implant. The confirmed Ledger finding, the continuing investigation and other manufacturers’ precautionary responses remain distinct.

Sources

Ledger implant investigation and reseller response · OneKey: Response to CryptoBilis incident