AI-rewritten: This is a summary of an article from Tom’s Hardware, rewritten by AI (Qwen, running locally) to make it easier to read. The facts come from the original article – read it for the full story.

---

Ledger is reviewing its sales policies and anti-tamper protections following the "Cryptobilis incident," a supply chain attack that resulted in $93 million in cryptocurrency theft, according to a Bloomberg report on October 13. Charles Guillemet, the company’s CTO, confirmed via social media that Ledger is examining how devices reach customers. He instructed users with tampered signers to contact support for shipping instructions and advised those who opened their own devices to review safety guidelines before doing so again.

In a separate announcement, CEO Pascal Gauthier stated that physical supply chain tampering poses a risk to the entire industry. Ledger plans to review controls for both direct sales and resellers while inviting researchers and vendors to collaborate on assessing these practices. The incident was first noticed on October 9 when hundreds of secure wallets drained simultaneously across Bitcoin, Ethereum, and Tron networks. Investigation revealed that almost all affected wallets were procured from CryptoBilis, an authorized reseller covering Malaysia and Southeast Asia, which Ledger ordered to halt all sales immediately.

Further investigation on October 10 showed attackers had manually installed unauthorized chips with cellular modules inside brand-new devices. These rogue chips recorded the OLED output or raw hardware data lines when users generated their recovery seed phrases and transmitted the unencrypted phrase over LTE networks to external servers. This modification bypassed Ledger’s standard "Genuine Check" software protocol because the chip sat outside the main microchip running the firmware. Ledger insists its internal infrastructure, firmware code, and direct sales channels remain uncompromised. The company is restructuring vendor verification to enforce tighter tracking and banning the resale of returned units while advising users to transfer funds to a freshly generated wallet.