Ledger is investigating a hardware supply-chain attack involving cryptocurrency wallets sold by Southeast Asian reseller CryptoBilis, after discovering that hidden electronic components could extract users’ recovery phrases and send them to attackers.

In an update shared on X Tuesday, Ledger explained that the unauthorized component was concealed within the wallet’s casing. When users set up their devices and the 24-word recovery phrase appeared on the screen, a microcontroller inside the implant could identify the words and transmit them over an LTE connection using an embedded SIM (eSIM).

A recovery phrase acts as the master key to a crypto wallet. Anyone who obtains it can restore the wallet on another device and move the funds without needing the original hardware or altering transactions on the affected signer.

The disclosure marks Ledger’s first public explanation of how the CryptoBilis-linked thefts were technically carried out. The company emphasized that the implant did not interfere with the Secure Element, which safeguards private keys, or modify the wallet’s operating system, transactions or digital signatures. Ledger therefore classified the incident as a physical supply-chain attack, not a compromise of its software or internal systems.

Ledger Chief Technology Officer Charles Guillemet said the company would review its reseller controls and strengthen protections against hardware tampering. He also invited security researchers and other vendors to cooperate on improved detection techniques and supply-chain tracking procedures.

Chief Executive Pascal Gauthier said the review would examine safeguards across both direct sales and reseller channels. Investigators are still working to identify who installed the unauthorized components and determine where the devices were altered before reaching customers.

Separately, Mark Karpeles, the former chief executive of Mt. Gox, said he had discovered a suspected surveillance implant in a Ledger Flex device purchased at Singapore Airport.

Ledger confirmed that an unauthorized implant had been found in one affected signer. It said all confirmed losses from the October 9 incident involved devices sold through CryptoBilis. No theft involving a signer purchased elsewhere has been verified, although the company is investigating reports of possible implants in devices from other locations.

The company has not provided an official count of victims or confirmed the total amount stolen. On-chain researchers have estimated that losses could reach $93.2 million across more than 300 wallets. Tether has frozen $10 million in USDT associated with the incident.

CryptoBilis has suspended sales of Ledger signers. Ledger advised customers who purchased devices from the reseller not to initialize them. Users who have already used an affected device should move their assets to a new device secured with a newly generated recovery phrase.