Ledger's Genuine Check Passed on Bugged Wallets. Is Yours Safe?

Ledger's own security team has now confirmed what many hardware-wallet owners assumed was impossible: a signer that looked sealed, ran genuine firmware and passed the official authenticity test was still quietly leaking its owner's recovery phrase over a mobile network. If you keep crypto on a hardware wallet, the reader question is uncomfortable but simple: if Ledger's Genuine Check passed on bugged devices, how do I know mine is safe — and what should I actually do?

The short answer

A passed Genuine Check proves that the Secure Element chip inside your device is authentic. It does not prove that nothing else was added to the device. In this case the attacker never touched the chip; an extra component read the 24 words off the screen during setup. So the check worked as designed and still could not catch it. Ledger says every confirmed theft so far traces to units sold by one reseller, CryptoBilis, in Southeast Asia. If you bought from that reseller, follow Ledger's guidance: do not set the device up, and if you already have, move your funds to a new signer with a new recovery phrase. If you bought elsewhere, the confirmed risk is lower, but where your device came from now matters as much as what the app tells you.

What Ledger has confirmed, in order

The timeline matters because the story moved from "reports of losses" to "confirmed implant" in four days.

• October 9: Ledger Support said on X it was investigating reports of lost funds from users in Southeast Asia who bought from CryptoBilis, and that it had asked the reseller to pause all sales and shipments. Buyers from the last 90 days were told not to start setup, and those who had were told to consider moving assets to a new signer with a new seed. The same day, The Block reported a third-party loss estimate above $86 million.
• October 10: Ledger confirmed that one affected user's signer contained an unauthorized hardware implant, according to the company's later Donjon update on X (October 13).
• October 13: Ledger's Donjon security team described the mechanism. The implant sits inside the enclosure and reads what the screen shows; when the recovery-phrase screens appear, its microcontroller decodes the words and transmits them over LTE using a provisioned eSIM. Ledger said the implant does not modify the Secure Element or the Ledger operating system and does not alter transactions or signatures.
• October 13: In a separate post, Ledger said MediaMarkt Saturn had stopped selling Ledger devices in its stores and online, with Ledger's alignment, after one customer in Germany reported an implant. Ledger said no loss of funds had been reported in that case.

Why the Genuine Check could not see it

The Genuine Check is a cryptographic challenge. Ledger Wallet asks the device's Secure Element to sign a challenge with a key injected at the factory, then verifies the answer against Ledger's servers. That is strong protection against counterfeit chips and fake firmware. It is not an inspection of the circuit board.

Ledger says as much in its own guide to buying a signer safely: the check cannot detect unauthorized physical modifications to the hardware, such as spying implants, if the original Secure Element remains intact. Tech Times (October 13) reported that implanted devices passed the check for exactly this reason. The attacker did not need to break the chip. They only needed to watch the one moment when the secret is shown to a human.

Why setup is the weak moment

A hardware wallet's promise is that your private keys never leave the Secure Element. That still held here. But the recovery phrase is, by design, displayed once so you can write it down — and anything that can see the screen can see the phrase. Once an attacker has those 24 words, they can rebuild your wallet on any device and sign whatever they like. No firmware exploit is needed.

How big is it?

Nobody has an official number. Ledger has said the figures circulating online come from third parties and that it has not fully verified them, and it has not disclosed how many users are affected.

The most detailed public tally comes from on-chain analytics firm Bitquery, which on October 12 revised its estimate to $102.0 million drained from 324 wallets across TRON, Bitcoin, Ethereum, Solana, BNB Chain and Polygon, up from an earlier $93.2 million. Bitquery also reports that dozens of wallets signed the same request within seconds, which it reads as one thief holding all the keys, and that Tether froze about $10 million in USDT across 20 wallets. Treat those as one analyst's estimates, not a confirmed total. Help Net Security (October 12) cited the $93 million figure, and earlier reports used $86 million — the spread reflects different counting methods and timing, not contradictory facts.

The fallout beyond Ledger

The incident has turned into a question about resellers in general. Bloomberg reported on October 13 that OneKey had dropped CryptoBilis and was reviewing its resellers. The Crypto Times reported the same day that Trezor removed CryptoBilis from its reseller list and is overhauling its reseller network; Trezor said it had received no reports of tampered Trezor devices from that seller. The Block (October 13) reported CryptoBilis has suspended sales of its hardware-wallet inventory pending the investigation.

One point is easy to miss: CryptoBilis was described in coverage as an official Ledger reseller, not a random marketplace seller. "Buy only from authorized resellers" remains good advice, but this case shows it reduces risk rather than eliminating it.

What to do with the device you already own

1. Check where it came from. If you bought from CryptoBilis, do not set it up. If you already did, move funds to a new signer with a freshly generated recovery phrase — that is Ledger's guidance, and it is the only step that removes the risk, because a leaked phrase cannot be "un-leaked".
2. Do not reuse the old phrase on a new device. Moving the same 24 words to clean hardware does nothing if those words were already transmitted.
3. Treat red flags as disqualifying. Ledger says a legitimate device never arrives with a pre-filled recovery phrase or PIN, and replacements are never sent unsolicited. An opened or altered package means stop and contact support.
4. Ignore anyone who asks for your words. Ledger states it will never call you, message you directly or ask for your 24-word phrase. Incidents like this reliably attract impersonators offering "help".
5. Keep the Genuine Check — and understand its limits. A failed check is still a hard stop. A passed one is a necessary signal, not a clean bill of health.

What we know vs. what we're inferring

Known (from Ledger): at least one CryptoBilis-sold signer contained an implant; it reads the recovery phrase from the screen and sends it over LTE via an eSIM; it does not alter the Secure Element, the OS, transactions or signatures; all confirmed losses tie to CryptoBilis units; Ledger reports no compromise of its own infrastructure; MediaMarkt Saturn has paused Ledger sales after one German report with no reported losses.

Not established: who installed the implants or at what point in the supply chain; whether the German device belongs to the same campaign; how many units are affected; the total stolen.

Our inference: because the attack targets the display rather than the chip, any wallet that shows its recovery phrase on screen is exposed to the same class of tampering if the hardware is intercepted before it reaches you. That is a supply-chain problem, not a Ledger-only flaw — but Ledger is where it has been confirmed.

What to watch next

• Ledger Donjon's full findings: the company says more analysis will follow but has given no date. Look for the implant's origin and the affected model list.
• The MediaMarkt case: whether Ledger links the German device to CryptoBilis or treats it as separate, and when sales resume.
• Bitquery's running tally and freezes: further Tether or Circle freezes would show how much of the stolen funds can still be stopped.
• January 1, 2027: the date Trezor has reportedly set for its reseller changes to take effect, per coverage of a letter to partners.

Educational information only — not financial advice.