What changed
When the CryptoBilis wallet drains were first reported on 9 October, the cause was unknown. Ledger has now published a mechanism.
On 13 October, Ledger said its Donjon security team found an unauthorized hardware implant inside an affected signer. The component sat behind the device screen, watched for the 24-word recovery phrase shown during setup, decoded those words with a microcontroller and sent them out over LTE using an eSIM.
That matters because the implant did not need to break Ledger's Secure Element or change a transaction. It waited for the device itself to display the backup that controls the wallet.
Ledger's 15 October incident statement says attackers bought genuine devices, opened them, added custom components and put them back into distribution through resellers in Southeast Asia. The company describes the group as highly organized. That attribution is Ledger's conclusion from its investigation, not an independently established court or law-enforcement finding.
How the implant bypassed the usual protection
A hardware wallet is built to keep private keys away from a normal computer. The Secure Element is the hardened chip meant to protect key material and approve signatures.
The implant described by Ledger went around that boundary. It targeted the recovery phrase while it was visible on the hardware wallet's own screen during setup.
Anyone who learns that phrase can recreate the same wallet on another device and move the funds. They do not need to compromise the Secure Element afterwards. They also do not need to alter a transaction on the original signer.
Ledger says the implant was a separate component and did not modify its Secure Element, operating system, transactions or signatures. CoinDesk, The Block, Decrypt and Cointelegraph independently reported the disclosure. Their reports agree on the screen-reading implant and LTE transmission mechanism.
The technical mechanism still comes from Ledger's own reverse engineering. The newsrooms did not independently take apart the same implant, so the finding should be read as a company security-team disclosure that has been independently reported, not as five separate forensic examinations.
What is confirmed and what is not
Ledger says every confirmed loss in the incident involved a device sold by CryptoBilis. It has not confirmed the total number of victims or the total amount stolen.
Outside analysts have published loss estimates above $86 million across several blockchains. Ledger says those figures remain unverified. On-chain tracing can follow transfers, but it cannot prove that every address belongs to the same incident or show how a recovery phrase was obtained.
The geographic scope is also unsettled. MediaMarkt Saturn removed Ledger devices from sale after a customer in Germany reported an implant, and other people have reported suspicious devices elsewhere. Ledger has not verified a drain tied to a device bought outside the CryptoBilis cases. Its 15 October statement says units it spot-checked in other markets and warehouses were clean.
Bitcoin.com reported that Ledger asked resellers and distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales while the investigation continues.
Why this changes the custody lesson
Our first report on the CryptoBilis drains said supply-chain tampering was still only a hypothesis. That is the part that changed.
The incident shows a limit of hardware isolation. A signer can keep its protected chip intact and still fail if a hidden component can observe a recovery phrase before the wallet is fully in the user's control.
It also shows why "genuine hardware" is not the same as "untampered hardware." Ledger says the affected devices began as genuine products. The compromise happened later in distribution.
Ledger has told CryptoBilis buyers not to initialize unused devices. People who already initialized one were told to move funds to a new device created with a new recovery phrase. Reusing the old phrase would recreate the same exposed keys.
The remaining questions are about scale and responsibility: how many devices were changed, where in the distribution chain that happened, who carried it out and how much was actually stolen. Ledger says its investigation with law enforcement is continuing.