Field note — 09 Oct 2026
The device’s own authenticity check passed. The implant was behind it.
A recovery phrase was captured on screen during setup and carried out over an embedded eSIM — across a network the owner never touched.
Ledger confirmed an unauthorised hardware implant in devices sold through CryptoBilis, an authorised reseller listed on its own distributor page, covering Malaysia, Indonesia and the Philippines. The implant watched the screen during setup, captured the 24-word recovery phrase, and sent it to the attacker over LTE using an embedded eSIM. Roughly $93M was drained from around 315 wallets across six chains.
The seed never crossed a network the owner controlled, so nothing in their infrastructure could have caught it. Reporting indicates the vendor’s genuine-device check passed on implanted units.
What it meansCustody design that begins at “initialise the device” starts one step too late. Provenance, initialisation conditions and a rehearsed migration path are part of the control, not preliminaries to it.