A review published by Galaxy Research on October 16 links the tampered Ledger hardware wallet attack, known as the CryptoBilis incident, to coordinated cryptocurrency withdrawals. It adds a detailed on-chain account of the losses to earlier disclosures from Ledger and independent researchers about how the implants operated.

What affected owners need to know

Replacing the hardware alone is not enough if a recovery phrase was exposed, because that phrase can restore the same wallet on another device. The required remedy is a newly generated phrase on trusted hardware, followed by a transfer of assets to addresses derived from it.

In brief

• Genuine Check authenticates the Secure Element; it does not inspect every component inside the device.
• The implant captured recovery words displayed during setup and sent them over its own cellular connection.
• Galaxy estimates that at least $91 million left 474 addresses within the scope of its research.
• A new PIN, factory reset or clean replacement device cannot revoke a recovery phrase an attacker already holds.

A passed Genuine Check did not mean the device was untouched

Ledger's Genuine Check is a cryptographic authentication process. The company's server sends a challenge, and the device's Secure Element — the tamper-resistant chip that stores the device's cryptographic secrets — responds with a signature that can be verified against Ledger's manufacturing attestation. A successful verification establishes that the responding Secure Element is genuine.

The key used for this device check is separate from the owner's wallet recovery phrase, and that distinction explains how the affected devices could pass the check. The attacker did not need to extract a secret from the protected chip or forge its response. Instead, the original Secure Element remained in place while separate hardware inside the device observed information reaching the screen.

Ledger Donjon's documentation sets out that limitation directly: Genuine Check cannot detect an unauthorized physical modification, including a spying implant, when the original Secure Element remains intact.

A passed check still serves a purpose, because it verifies the component designed to answer the challenge. It is not a physical inspection of the enclosure, however, and it offers no guarantee that nothing else has been added inside it.

The implant watched the display, then used its own radio

Ledger's earlier confirmation of an implant in an affected device established physical tampering. Its subsequent explanation described a component that captured the 24-word recovery phrase during setup and transmitted it over LTE using an embedded SIM.

Tibane Labs' examination of Nano X specimens provides further detail on the technique. Added circuitry monitored the screen's data lines, reconstructed the words as they were displayed, and used a cellular modem to transmit them. The implant required neither a camera nor the connected computer's internet connection, so the stolen words left the device without passing through the owner's computer or network.

That matters because the recovery phrase is the wallet's master backup. Once an attacker holds a usable copy, the wallet can be restored in another environment and transactions can be signed there. The original Ledger device never needs to approve the later theft.

The specimens Tibane examined also demonstrate why a quick visual comparison is not a reliable safety test. One design concealed components beneath the display while retaining the original battery. Loose wiring, an unusually small battery or an altered exterior therefore cannot be treated as universal warning signs.

These examinations document the implant method, not every device involved in the CryptoBilis incident. They do not establish that every compromised wallet used the same design or entered distribution through the same route, so additional device examinations could still adjust that picture.

A copied phrase can become a multi-chain loss

Galaxy estimates that approximately $91 million left 474 addresses across Bitcoin, Ethereum, Arbitrum, Polygon and TRON. Its analysis excluded BNB Chain, which other trackers included, so Galaxy presents its figure as a floor rather than a complete incident total. The final loss figure could therefore exceed Galaxy's estimate once BNB Chain is counted.

The Bitcoin withdrawals began on October 7. Across the assets Galaxy examined, about 88% of the value — roughly $80 million — moved during a single hour beginning at 05:00 UTC on October 9. That timing supports the view that the withdrawals were coordinated rather than unrelated losses, though it does not show when every recovery phrase was captured, how long the attackers held the information, or whether each affected owner used the same implant version.

The 474-address figure is also not a count of people, wallets or physically examined devices. A single owner may control multiple addresses, and blockchain tracing alone cannot establish which hardware was used for each wallet. The $91 million estimate is Galaxy's on-chain assessment, not a Ledger-confirmed total or a compensation commitment.

Authorized resale reduced risk, but did not prove a device was untouched

In its October 15 response, Ledger said attackers bought genuine devices, fitted them with hidden components, and returned them to distribution through resellers in Southeast Asia. The company said its chip, operating system and servers were not compromised.

Ledger also said it requested sales suspensions from authorized resellers and distributors in Southeast Asia and Hong Kong. Its teams inspected devices bought from stores as well as warehouse samples, including checks in Germany, and reported that the units examined were clean.

The company has reiterated that returned devices must never be resold, even if they appear new and unopened. Its updated requirements direct retailers to keep stock away from shelves and display areas, hand devices to buyers only at the point of purchase, and report unusual products promptly.

Those controls reduce the chance that a handled device reaches a buyer. They also explain why "buy only from an authorized reseller" cannot be the whole answer: CryptoBilis had itself been listed as authorized.

Ledger's purchasing guidance separates two risks that are often conflated. Genuine Check remains relevant when assessing a counterfeit device, while physical custody and distribution controls address a genuine device modified after it left the factory.

For readers tracking the case, the developments worth watching sit on two tracks: further communications from Ledger, which issued updates on October 13 and October 15, and continued independent on-chain tracing of the kind Galaxy published on October 16.

What does and does not protect a wallet after phrase exposure

Ledger's instructions for CryptoBilis buyers draw the same dividing line. Its October 13 investigation update told buyers not to set up unused units or enter an existing recovery phrase into them, and advised owners who had already initialized a device to move assets to a new signer with a new recovery phrase.

For anyone who suspects a phrase was exposed, the priority is securing the wallet rather than proving whether the hardware has been altered. Fresh keys must be generated on trusted hardware, and assets must then be sent to addresses controlled by those new keys. The suspect device should not generate the replacement wallet.

People who have lost funds or believe they hold a modified device should contact Ledger through its official support channels and coordinate with law enforcement before opening or shipping the hardware. Preserving a device may matter to an investigation, but informal disassembly is neither a complete safety test nor a substitute for moving funds secured by an exposed phrase.

This article is provided for informational purposes only and does not constitute financial or investment advice. Follow current manufacturer guidance when handling a potentially compromised device.