Ledger finds a cellular implant inside a CryptoBilis-sold signer that copies recovery phrases at setup

The loss figure is the softest number in the story. Bitquery's October 12 analysis put suspected thefts at about $102 million across 324 wallets ^[13], an average of roughly $315,000 a wallet ^[11], and Ledger has not confirmed the loss calculation, the number of affected customers, or that every suspicious transaction came from the implant ^[14]. The hard evidence is narrower: Ledger found the implant inside one customer's device on October 10 ^[8]. That is 324 wallets to one confirmed device ^[12]. A wallet is not a device, so the ratio is not a count of tampered units, but it shows how much of the picture rests on chain analysis.

The gap bears on the broader rule, that any reseller-bought hardware wallet should be treated as a compromised supply chain. Ledger has not gone that far. "We have not verified a drain linked to a signer bought elsewhere," Ledger said ^[5], while its researchers keep reviewing reports of hardware modifications in other devices and locations ^[7]. The account describes CryptoBilis as a reseller serving Southeast Asian markets, and "gray market" is a label it does not use ^[10].

We think the evidence supports a narrower rule: treat CryptoBilis-sold units as suspect, and treat every other channel as unproven in both directions. Widening it depends on the route the components took into the devices ^[9], and there are three ways that can come out. If they were fitted at or near CryptoBilis, the risk stays with that stock and the blanket rule overshoots. If they were fitted upstream, on a path other sellers share, the blanket rule is right and the 324-wallet count could rise. If some of the 324 wallets were emptied by something other than the implant, the loss estimate falls toward the cases Ledger can tie to hardware ^[14]. A single verified drain from a signer bought through another seller would move us to the blanket rule.