Ledger said confirmed incidents remain contained to Southeast Asia and that it has not verified a drain linked to a device bought elsewhere. The company also said it had no indication its infrastructure, systems, services or direct sales channel had been compromised.
The regional request follows MediaMarktSaturn's sales pause, which Ledger confirmed earlier on Oct. 13 after a customer reported an implant in Germany. Ledger said no fund losses were reported in that case.
Recovery Phrases at Risk
In its earlier technical update, Ledger said its Donjon security team found that the implant reads the 24-word recovery phrase displayed during setup and transmits it over the LTE cellular network using an eSIM. The separate component does not modify the Secure Element chip or Ledger operating system, or alter transactions or signatures, according to the company.
Ledger's hardware-integrity guide says its Genuine Check cannot detect spying implants if the original Secure Element remains intact. Passing that check therefore does not rule out this kind of physical tampering.
The technical update tells CryptoBilis customers not to set up unused devices and to contact Ledger Support. Those who already set up a device should promptly transfer assets to a new device with a new recovery phrase, Ledger says. It warns against entering or restoring any recovery phrase on a CryptoBilis-bought device.
The new regional announcement directs users to Ledger Support for guidance. It does not extend those specific setup and transfer instructions to every buyer in the seven markets or set out a refund or replacement program.
Ledger has not confirmed the total number of affected users or the value lost. The company says it is still determining who tampered with the devices and where in the distribution chain it happened; its Donjon team will analyze the devices it receives.
thedefiant.io
