Pinned Tweet
Today marks a new chapter for @Ledger. We’re introducing Ledger Atom™️, a security and privacy device built to protect everything you value.
Ledger Atom runs your everyday apps, with a secure chip, a secure screen, and Ledger OS™️ for the moments that matter. Your money. Your . Your agents. Everything important to you, secured by Ledger.
Shipping in Summer 2027.
Reserve yours now: shop.ledger.com/pages/ledger-a…
Ledger Atom runs your everyday apps, with a secure chip, a secure screen, and Ledger OS™️ for the moments that matter. Your money. Your . Your agents. Everything important to you, secured by Ledger.
Shipping in Summer 2027.
Reserve yours now: shop.ledger.com/pages/ledger-a…
1,018
83
914
470,372
Pascal Gauthier @Ledger retweeted
Ledger Agent Intent 0.3.0 is live.
Agent Intent lets your AI agent propose transactions while you stay in control. Your agent (@claudeai Code or Duet, @OpenAI Codex or Dot, @openclaw, @NousResearch Hermes, @Meta Muse, etx) drafts a send or a swap. You review it and approve it on your @Ledger signer. The agent never holds your keys.
Agents propose. Humans approve. Hardware enforces.
What's new in 0.3.0:
- Every pending proposal shows its USD value and estimated network fee, and refreshes automatically.
- The transaction is rebuilt right before you sign, so what you approve is current.
- A low-balance warning appears before you start signing.
- Reject on your Ledger and the proposal stays pending, so you can review it again later.
- You see a block explorer link once it goes through.
- Clearer messages when something fails, including when a VPN blocks the connection.
- See which agent is asking, with its logo. Give your agents custom avatars.
- wallet-cli 2.13.0 on npm: faster startup and clearer setup on Linux.
- Security hardening across the app and CLI.
Agent Intent lets your AI agent propose transactions while you stay in control. Your agent (@claudeai Code or Duet, @OpenAI Codex or Dot, @openclaw, @NousResearch Hermes, @Meta Muse, etx) drafts a send or a swap. You review it and approve it on your @Ledger signer. The agent never holds your keys.
Agents propose. Humans approve. Hardware enforces.
What's new in 0.3.0:
- Every pending proposal shows its USD value and estimated network fee, and refreshes automatically.
- The transaction is rebuilt right before you sign, so what you approve is current.
- A low-balance warning appears before you start signing.
- Reject on your Ledger and the proposal stays pending, so you can review it again later.
- You see a block explorer link once it goes through.
- Clearer messages when something fails, including when a VPN blocks the connection.
- See which agent is asking, with its logo. Give your agents custom avatars.
- wallet-cli 2.13.0 on npm: faster startup and clearer setup on Linux.
- Security hardening across the app and CLI.
15
6
288
7,130
Pascal Gauthier @Ledger retweeted
I’ve been using Ledger hardware wallets for many years, and the recent discoveries of malicious hardware implants haven’t shaken my trust in Ledger.
If anything, they’ve reinforced something I’ve always believed: we should have the right and the ability to inspect and verify the security of the devices we trust with our Bitcoin.
Bitcoin has always stood for a simple principle:
Don’t trust, verify.
That principle shouldn’t stop at software or cryptography. It should extend to the physical devices we use to protect our private keys.
I have no problem with sealed or tamper-evident designs, as long as they’re transparent and allow independent inspection.
Ledger devices are relatively easy to open and examine. That’s one of the reasons these malicious hardware implants could be discovered and investigated by security researchers.
No hardware wallet is completely immune to supply-chain attacks. Whether it’s Ledger, Trezor, OneKey, or any other brand, similar threats can exist.
But this raises a very practical question: What about ordinary users?
Most people simply don’t have the technical skills to inspect hardware.
Identifying a malicious chip implant is difficult enough. Even recognizing whether a circuit board has been modified is beyond the capabilities of most users.
Are we really expecting everyone to study electronics, chip design, and cryptography just to keep their Bitcoin safe?
Of course not.
And that’s why I believe the hardware wallet industry still has a long way to go.
First, manufacturers need to be more open and transparent. Independent security researchers, laboratories, and the broader security community should be able to inspect and audit these devices. Their findings should help protect everyone, including those who lack the technical expertise to verify hardware themselves.
Second, manufacturers must take supply-chain security seriously. From production and packaging to shipping and final delivery, every stage should be designed to minimize the risk of tampering. Users should also have access to simple and reliable ways to verify their devices’ authenticity.
For ordinary users, the best practical steps today are to buy directly from official stores, initialize and verify devices using official software, make sure recovery phrases are generated by the devices themselves, and always verify transaction details on the device’s screen.
Of course, none of these measures can guarantee 100% security.
For those holding significant amounts of Bitcoin, multisignature setups using hardware wallets from different manufacturers may offer an additional layer of protection against the compromise of a single device, although they also introduce additional complexity.
I strongly believe that we cannot place the entire burden of security on users.
It’s perfectly reasonable that most people can’t inspect chips or circuit boards. We shouldn’t expect every Bitcoin holder to become a hardware security expert.
The industry should be working toward a future where ordinary people can protect their assets with confidence, even without understanding electronics or chip design, through transparent hardware, independent security research, and reliable security practices.
Physical inspection alone cannot guarantee security. But at the very least, those with the expertise should be free to inspect, investigate, and challenge the devices we rely on.
I still trust Ledger. But I also hope Ledger, along with the entire hardware wallet industry, continues to improve transparency and welcomes greater independent scrutiny.
Trust should stand up to verification.
We still have a long way to go in making Bitcoin self-custody safer and more accessible for everyone.
If anything, they’ve reinforced something I’ve always believed: we should have the right and the ability to inspect and verify the security of the devices we trust with our Bitcoin.
Bitcoin has always stood for a simple principle:
Don’t trust, verify.
That principle shouldn’t stop at software or cryptography. It should extend to the physical devices we use to protect our private keys.
I have no problem with sealed or tamper-evident designs, as long as they’re transparent and allow independent inspection.
Ledger devices are relatively easy to open and examine. That’s one of the reasons these malicious hardware implants could be discovered and investigated by security researchers.
No hardware wallet is completely immune to supply-chain attacks. Whether it’s Ledger, Trezor, OneKey, or any other brand, similar threats can exist.
But this raises a very practical question: What about ordinary users?
Most people simply don’t have the technical skills to inspect hardware.
Identifying a malicious chip implant is difficult enough. Even recognizing whether a circuit board has been modified is beyond the capabilities of most users.
Are we really expecting everyone to study electronics, chip design, and cryptography just to keep their Bitcoin safe?
Of course not.
And that’s why I believe the hardware wallet industry still has a long way to go.
First, manufacturers need to be more open and transparent. Independent security researchers, laboratories, and the broader security community should be able to inspect and audit these devices. Their findings should help protect everyone, including those who lack the technical expertise to verify hardware themselves.
Second, manufacturers must take supply-chain security seriously. From production and packaging to shipping and final delivery, every stage should be designed to minimize the risk of tampering. Users should also have access to simple and reliable ways to verify their devices’ authenticity.
For ordinary users, the best practical steps today are to buy directly from official stores, initialize and verify devices using official software, make sure recovery phrases are generated by the devices themselves, and always verify transaction details on the device’s screen.
Of course, none of these measures can guarantee 100% security.
For those holding significant amounts of Bitcoin, multisignature setups using hardware wallets from different manufacturers may offer an additional layer of protection against the compromise of a single device, although they also introduce additional complexity.
I strongly believe that we cannot place the entire burden of security on users.
It’s perfectly reasonable that most people can’t inspect chips or circuit boards. We shouldn’t expect every Bitcoin holder to become a hardware security expert.
The industry should be working toward a future where ordinary people can protect their assets with confidence, even without understanding electronics or chip design, through transparent hardware, independent security research, and reliable security practices.
Physical inspection alone cannot guarantee security. But at the very least, those with the expertise should be free to inspect, investigate, and challenge the devices we rely on.
I still trust Ledger. But I also hope Ledger, along with the entire hardware wallet industry, continues to improve transparency and welcomes greater independent scrutiny.
Trust should stand up to verification.
We still have a long way to go in making Bitcoin self-custody safer and more accessible for everyone.
14
1
40
9,964
Pascal Gauthier @Ledger retweeted
Tangem appeals to the lowest common denominator in crypto, that's why it's filled with bagholders from $XRP $KAS and affiliates paid peanuts to shill.
I will make it simple for people to understand today.
In December 2024, @Tangem had a critical vulnerability where its mobile E KEYS into logs that got attached to support emails. They deleted early warning posts on Reddit.
Inb4 "muh seedless, muh safe", yes, your keys never touch the app. Your TRANSACTIONS touch it every single time. The attack vector is the APP ITSELF and the OS it runs on. Read on.
Tangem's Nirvana Fallacy is: seatbelts have occasionally failed, therefore remove seatbelts.
Ledger/Trezor clear-signing bug: worst case, the screen lies about transaction parameters.
Tangem's design: the (phone) screen can lie about transactions as the permanent baseline.
>"Hardware Implant"
Physical implants predate Bitcoin. They are device agnostic. The phone on which Tangem's app runs could have an implant too, what then?
"Tangem Genuine Check" was exploited by Ledger already. Counterfeit Tangem Cards are not just theoretical:
ledger.com/tangem-genuine…
>"Clear Signing Bugs"
Clear-signing bugs are a failure of a layer Tangem doesn't have at all. Tangem signs whatever payload the app hands it, every time, by design.
Car airbags have defects, even from Toyota, the most reliable car manufacturer that exists. Tangem's solution is to remove airbags altogether.
Both Ledger and Trezor vulnerabilities are routinely patched.
You can never patch your laser vector:
donjon.ledger.com/blog/bypassing…
Or tearing vector:
ledger.com/blog-brute-for…
...because there's no update channel for users.
Your security page still advertises resistance to "fault injection attempts". Donjon's laser attack IS fault injection. It works and it's unpatchable by you.
[Eureka Moment]
@Ledger and @Trezor clear signing bugs were discoverable BECAUSE the trusted display can be audited against what it signs.
In Tangem's model, there's nothing to audit. Read that back slowly because it's easy to miss. It's evidence the architecture is testable.
Ledger/Trezor is like bank that publishes audited accounts. It will occasionally have an auditor find an error:
1. Construct a transaction.
2. Record what the device displays.
3. Record what the device actually signs (the signature reveals exactly what was signed).
4. Compare the two.
Tangem is a bank that keeps no books. Therefore it will never have an accounting error found:
1. Construct a transaction.
2. Record what the app displays.
3. Record what the card signs.
4. They differ: the app showed one address, the card signed another.
In Tangem's case, there's no vulnerability because Tangem never promised those two things should match. The card signs whatever payload the app hands it. The system is working exactly as designed. It's the default behavior for a compromised OS.
>"And more hardware components can introduce more attack vectors."
So your solution to a purpose-built trusted display driven by minimal firmware (Ledger/Trezor) is a whole ass smartphone, running a full OS, with millions of lines of code and attack vectors.
Genius.
>"muh security hardened app"
You never replied to my original post here because you can't:
x.com/HalesFall/stat…
Tangem was also audited by Riscure in 2023, yet you still got smoked by Ledger later:
tangem.com/en/blog/post/t…
Not even Apple or Google can defend an app from a kernel-level exploit on their own OS, that's why Ledger/Trezor don't try. They verify OUTSIDE the blast radius. Your "hardened app" lives inside it.
[Latest Exploits]
See the videos attached, there's tons more I haven't included. You have neither the money, resources, or expertise to defend from OS exploits. How many of your users are even using Pixel 8 series and later, or iPhone 17 series and later? That matters greatly too.
Your "app" layer is dead-on-arrival. Ledger & Trezor provide mitigation where you cannot.
Tangem is more akin to a software wallet because it implicitly trusts a compromised OS. The secure element is theatre since the card will sign anything passed to it.
I will make it simple for people to understand today.
In December 2024, @Tangem had a critical vulnerability where its mobile E KEYS into logs that got attached to support emails. They deleted early warning posts on Reddit.
Inb4 "muh seedless, muh safe", yes, your keys never touch the app. Your TRANSACTIONS touch it every single time. The attack vector is the APP ITSELF and the OS it runs on. Read on.
Tangem's Nirvana Fallacy is: seatbelts have occasionally failed, therefore remove seatbelts.
Ledger/Trezor clear-signing bug: worst case, the screen lies about transaction parameters.
Tangem's design: the (phone) screen can lie about transactions as the permanent baseline.
>"Hardware Implant"
Physical implants predate Bitcoin. They are device agnostic. The phone on which Tangem's app runs could have an implant too, what then?
"Tangem Genuine Check" was exploited by Ledger already. Counterfeit Tangem Cards are not just theoretical:
ledger.com/tangem-genuine…
>"Clear Signing Bugs"
Clear-signing bugs are a failure of a layer Tangem doesn't have at all. Tangem signs whatever payload the app hands it, every time, by design.
Car airbags have defects, even from Toyota, the most reliable car manufacturer that exists. Tangem's solution is to remove airbags altogether.
Both Ledger and Trezor vulnerabilities are routinely patched.
You can never patch your laser vector:
donjon.ledger.com/blog/bypassing…
Or tearing vector:
ledger.com/blog-brute-for…
...because there's no update channel for users.
Your security page still advertises resistance to "fault injection attempts". Donjon's laser attack IS fault injection. It works and it's unpatchable by you.
[Eureka Moment]
@Ledger and @Trezor clear signing bugs were discoverable BECAUSE the trusted display can be audited against what it signs.
In Tangem's model, there's nothing to audit. Read that back slowly because it's easy to miss. It's evidence the architecture is testable.
Ledger/Trezor is like bank that publishes audited accounts. It will occasionally have an auditor find an error:
1. Construct a transaction.
2. Record what the device displays.
3. Record what the device actually signs (the signature reveals exactly what was signed).
4. Compare the two.
Tangem is a bank that keeps no books. Therefore it will never have an accounting error found:
1. Construct a transaction.
2. Record what the app displays.
3. Record what the card signs.
4. They differ: the app showed one address, the card signed another.
In Tangem's case, there's no vulnerability because Tangem never promised those two things should match. The card signs whatever payload the app hands it. The system is working exactly as designed. It's the default behavior for a compromised OS.
>"And more hardware components can introduce more attack vectors."
So your solution to a purpose-built trusted display driven by minimal firmware (Ledger/Trezor) is a whole ass smartphone, running a full OS, with millions of lines of code and attack vectors.
Genius.
>"muh security hardened app"
You never replied to my original post here because you can't:
x.com/HalesFall/stat…
Tangem was also audited by Riscure in 2023, yet you still got smoked by Ledger later:
tangem.com/en/blog/post/t…
Not even Apple or Google can defend an app from a kernel-level exploit on their own OS, that's why Ledger/Trezor don't try. They verify OUTSIDE the blast radius. Your "hardened app" lives inside it.
[Latest Exploits]
See the videos attached, there's tons more I haven't included. You have neither the money, resources, or expertise to defend from OS exploits. How many of your users are even using Pixel 8 series and later, or iPhone 17 series and later? That matters greatly too.
Your "app" layer is dead-on-arrival. Ledger & Trezor provide mitigation where you cannot.
Tangem is more akin to a software wallet because it implicitly trusts a compromised OS. The secure element is theatre since the card will sign anything passed to it.
A screen makes your hardware wallet safer? Think again.
Recent security incidents tell a different story.
1. Ledger, October 2026 — Hardware Implant
A hidden hardware implant captured recovery phrases directly from the device’s screen and transmitted them over LTE. The Secure Element remained intact.
2. Ledger, August 2026 — Transaction Mismatch
A Clear Signing vulnerability allowed the transaction parameters displayed on the screen to differ from those actually signed.
3. Trezor, May 2026 — Hidden ETH Transfer
A Clear Signing flaw could hide an additional ETH transfer while displaying a routine token transaction.
What this shows:
A screen doesn’t guarantee you’re seeing everything you’re signing. And more hardware components can introduce more attack vectors.
Why Tangem doesn’t need a screen:
• Your phone displays transaction details through a security-hardened app.
• Multiple protection layers help defend against UI manipulation, malicious overlays, and runtime attacks.
• Private keys remain inside the secure chip.
• No screen, no battery, no unnecessary hardware complexity.
tangem.com/en/blog/post/m…
Security is about protecting the entire system, not just adding more components.
Simply Tangem
53
21
152
48,386
Pascal Gauthier @Ledger retweeted
La France a inspiré et continuera d’inspirer.
Tesla (2026) | Daft Punk's Electroma (2006)
Tesla (2026) | Daft Punk's Electroma (2006)
2
2
6
1,652
👀
One of the biggest victims of the Ledger theft was a scammer themselves. They lost more than 60BTC, about $4.8M. The funds were from a task scam.
In this task scam, people were paid to fake sales and reviews of real items. Then a "negative balance" appeared, and they were told in order to get paid.
On Sep 22, the person behind the scam moved the proceeds into three separate Ledger addresses. On Oct 9, thieves emptied all three. One transfer each, into the same wallet. The wallet is reported as stolen funds.
35
1
37
16,075
Pascal Gauthier @Ledger retweeted
BREAKING: @solanamobile names @Ledger its first hardware partner.
The Seeker app, home to the Solana dApp Store and wallet, ships preinstalled on Ledger Atom and brings 1,500+ apps to Ledger users.
The Seeker app, home to the Solana dApp Store and wallet, ships preinstalled on Ledger Atom and brings 1,500+ apps to Ledger users.
Solana Mobile’s first hardware expansion partner is @Ledger.
The Seeker App, with the Solana dApp Store and wallet, will be integrated with Ledger’s new device.
Seekers, meet Ledger Atom. ⚛️🧵
204
172
1,392
163,679
Pascal Gauthier @Ledger retweeted
Your wealth is digital. The device you manage it with should be built for that.
Meet Ledger Atom™: the security of industry leading hardware, the convenience of your everyday apps, plus control over your AI tools, and a rapidly expanding platform of apps, all in one quantum ropose. You approve. Your Ledger signer enforces.
Meet Ledger Atom™: the security of industry leading hardware, the convenience of your everyday apps, plus control over your AI tools, and a rapidly expanding platform of apps, all in one quantum ropose. You approve. Your Ledger signer enforces.
838
428
2,605
950,963
Nature is healing. Thirty-three arrested in one op. Two point four billion in laundering traced. Three thousand wallets audited. Even when the worst happens, the money comes back. Ledger Atom drops today! thenationalnews.com/news/uae/2026/…
8
1
37
7,029
Pascal Gauthier @Ledger retweeted
🇫🇷 | 🚨 Ledger dévoile Atom, un appareil qui ressemble à un smartphone pour sécuriser ses cryptos, ses conversations et ses agents IA.
Prix : 849 € (sur réservations)
Livraison : été 2027
Tout ce qu’il faut savoir dans notre article à venir 👇
Prix : 849 € (sur réservations)
Livraison : été 2027
Tout ce qu’il faut savoir dans notre article à venir 👇
152
29
416
538,624
Pascal Gauthier @Ledger retweeted
LEDGER UNVEILS NEW SECURITY DEVICE WITH AI AGENT CONTROLS AND ADVANCED ANTI-TAMPERING PROTECTION
Ledger has announced Ledger Atom, a new security and privacy device that combines Android-based applications with Ledger’s secure operating system to protect Bitcoin, digital munications and AI agent activity.
Unlike traditional hardware signers, Ledger Atom can run everyday applications while isolating sensitive operations in a separate Secure Mode.
Key features include:
AI Agent Security:
Users can authorize sensitive actions performed by AI agents through physical confirmation on the device, including integration with OpenClaw.
Advanced Anti-Tampering: New protections designed to detect unauthorized opening of the device or removal of its display, alongside additional safeguards for internal components.
Hardware Privacy Switch: A physical switch cuts power to the cameras and microphone, preventing software from activating them.
Encrypted Messaging: OpenPGP support allows messages to be encrypted and decrypted in a secure environment, without exposing plaintext to messaging applications.
Post-Quantum Security: Hardware-accelerated cryptography designed to support emerging post-quantum encryption standards.
Secure Transactions: Users can initiate transactions and approve them on the device’s trusted display.
The announcement comes amid growing scrutiny of Ledger’s hardware security following the discovery of malicious physical implants in devices distributed through third-party retailers.
Ledger says Atom will feature its most advanced anti-tampering and tamper-evident protections to date.
The company is positioning Atom as a broader security platform that extends beyond cryptocurrency custody to AI agents, communications and digital identity.
Ledger has announced Ledger Atom, a new security and privacy device that combines Android-based applications with Ledger’s secure operating system to protect Bitcoin, digital munications and AI agent activity.
Unlike traditional hardware signers, Ledger Atom can run everyday applications while isolating sensitive operations in a separate Secure Mode.
Key features include:
AI Agent Security:
Users can authorize sensitive actions performed by AI agents through physical confirmation on the device, including integration with OpenClaw.
Advanced Anti-Tampering: New protections designed to detect unauthorized opening of the device or removal of its display, alongside additional safeguards for internal components.
Hardware Privacy Switch: A physical switch cuts power to the cameras and microphone, preventing software from activating them.
Encrypted Messaging: OpenPGP support allows messages to be encrypted and decrypted in a secure environment, without exposing plaintext to messaging applications.
Post-Quantum Security: Hardware-accelerated cryptography designed to support emerging post-quantum encryption standards.
Secure Transactions: Users can initiate transactions and approve them on the device’s trusted display.
The announcement comes amid growing scrutiny of Ledger’s hardware security following the discovery of malicious physical implants in devices distributed through third-party retailers.
Ledger says Atom will feature its most advanced anti-tampering and tamper-evident protections to date.
The company is positioning Atom as a broader security platform that extends beyond cryptocurrency custody to AI agents, communications and digital identity.
59
23
156
31,093
Pascal Gauthier @Ledger retweeted
The latest Ledger incident has led many to assume that other hardware wallets are inherently more secure.
But there’s a BIG factor being overlooked:
The number of vulnerabilities discovered depends partly on how hard we look.
And how hard we look is driven by economic incentives. 🧵
But there’s a BIG factor being overlooked:
The number of vulnerabilities discovered depends partly on how hard we look.
And how hard we look is driven by economic incentives. 🧵
1
4
13
1,331
Today. 2pm CET. Live from Ledger Op3n.
Something new is coming from @Ledger.
Watch here 👇
youtube.com/live/6_twUP3_G…
Something new is coming from @Ledger.
Watch here 👇
youtube.com/live/6_twUP3_G…
12
6
44
8,588
The CryptoBilis investigation continues. This is a complex investigation, and as CEO, I am leading it with my Executive team. We are dedicating time and resources to explore every aspect to protect @Ledger users and find the malicious actors. Ledger and I will continue to communicate only facts we can validate through authorized channels.
All confirmed fund losses connected to the incident disclosed on October 9th involve Ledger signers sold through CryptoBilis, a reseller in Southeast Asia. On October 10th, Ledger confirmed that one affected signer contained an unauthorized hardware implant. We have no indication that Ledger's infrastructure, systems or services were compromised. CryptoBilis has confirmed it stopped selling Ledger signers. The investigation is ongoing to determine who tampered with these signers or where in the distribution chain it happened. The @DonjonLedger will be examining the signers we receive, and Ledger Support is reviewing user reports to establish this.
We are reaching out to affected users and working with law enforcement. If you bought a Ledger signer from CryptoBilis and have not set it up, do not set it up. If you have set it up, transfer your assets promptly to a new signer with a new recovery phrase.
Do not send your signer to anyone before speaking with Ledger Support or local law enforcement, especially if you lost funds. Ledger will never call you, message you directly or ask for your 24-word recovery phrase.
Physical supply chain tampering is a risk for the whole industry. We are reviewing the controls that apply to our direct sales and to resellers, and we will share what we can. We are asking researchers and other vendors to work with us on chain-of-custody and tamper-detection practices. The Donjon's analysis is ongoing and will continue as we receive signers. Thank you to the users who contacted us through official channels.
Some claims and figures circulating online are unverified. Scammers often try to take advantage of incidents like this. Rely only on official Ledger channels for updates.
All confirmed fund losses connected to the incident disclosed on October 9th involve Ledger signers sold through CryptoBilis, a reseller in Southeast Asia. On October 10th, Ledger confirmed that one affected signer contained an unauthorized hardware implant. We have no indication that Ledger's infrastructure, systems or services were compromised. CryptoBilis has confirmed it stopped selling Ledger signers. The investigation is ongoing to determine who tampered with these signers or where in the distribution chain it happened. The @DonjonLedger will be examining the signers we receive, and Ledger Support is reviewing user reports to establish this.
We are reaching out to affected users and working with law enforcement. If you bought a Ledger signer from CryptoBilis and have not set it up, do not set it up. If you have set it up, transfer your assets promptly to a new signer with a new recovery phrase.
Do not send your signer to anyone before speaking with Ledger Support or local law enforcement, especially if you lost funds. Ledger will never call you, message you directly or ask for your 24-word recovery phrase.
Physical supply chain tampering is a risk for the whole industry. We are reviewing the controls that apply to our direct sales and to resellers, and we will share what we can. We are asking researchers and other vendors to work with us on chain-of-custody and tamper-detection practices. The Donjon's analysis is ongoing and will continue as we receive signers. Thank you to the users who contacted us through official channels.
Some claims and figures circulating online are unverified. Scammers often try to take advantage of incidents like this. Rely only on official Ledger channels for updates.
Update from Ledger Donjon on the CryptoBilis investigation 🔽
@DonjonLedger is investigating Ledger signers sold by CryptoBilis, a reseller in Southeast Asia, that contained an unauthorized hardware implant. Ledger confirmed this on October 10th for one affected user's signer. All confirmed fund losses tied to the incident disclosed on October 9th involve signers sold through CryptoBilis. We have not verified a drain linked to a signer bought elsewhere. CryptoBilis has confirmed it stopped selling Ledger signers while the investigation continues.
Based on the Donjon's analysis of the attack, the implant sits inside the enclosure and reads the data shown on the screen. During setup, the signer displays the 24-word recovery phrase. When the implant detects these screens, its microcontroller decodes the words and transmits them over LTE using a provisioned eSIM. The implant is a separate component. It does not modify the Secure Element or the Ledger operating system, and it does not alter transactions or signatures.
The Donjon will analyze the signers it receives and will share more as the investigation continues.
We have not confirmed the total number of affected users or the total value lost. Figures circulating online come from third parties and Ledger has not fully verified them. If your funds were drained and you have not contacted us, please do so through Ledger Support so we can include your case. We are also reviewing reports of implants in other signers and locations. We will continue to share information as the investigation progresses. Rest assured the Ledger team is going above and beyond to leave no stone unturned to investigate this situation to the strongest possible outcome.
If you bought a Ledger signer from CryptoBilis and have not set it up, do not set it up and contact Ledger Support. If you have set it up, transfer your assets promptly to a new signer with a new recovery phrase. Do not enter or restore any recovery phrase on a signer bought from CryptoBilis. Never enter your recovery phrase into a website, app or form.
If you lost funds or hold a tampered signer, contact Ledger Support at support.ledger.com and file a report with local law enforcement. Do not send the signer to anyone before speaking with Ledger Support or local law enforcement. If you lost funds, coordinate with law enforcement before opening the signer. Researchers and others with relevant information can write to security@ledger.com.
If you did not buy from CryptoBilis and want to inspect the inside of your signer, the guide is at support.ledger.com/article/440438…. Use caution and make sure your recovery phrase is backed up first, because opening a signer can damage it.
Ledger will never call you, message you directly, or ask for your 24-word recovery phrase. We will update this post when we verify new information.
86
24
250
38,870
Pascal Gauthier @Ledger retweeted
72 hour update on reseller CryptoBilis incident 🔽
As the investigation continues, we are working with relevant authorities. The volume of impacted devices is limited. We know this is concerning, especially for those directly affected, and we are reaching out to impacted users.
To date, all confirmed cases related to the disclosed draining incident of Oct 9th, 2026, involve devices sold through the Southeast Asia reseller CryptoBilis. Our systems and direct sales channels remain unaffected.
We take the CryptoBilis situation seriously and are actively investigating.
We encourage impacted users to reach out to Ledger Support through official channels and file complaints with their local law enforcement authorities. As a reminder, CryptoBilis has confirmed having ceased all sales of hardware wallets.
We are reminding our authorized resellers and distributors to source products only through authorized channels and never to restock returned products.
Also, we strongly advise users not to purchase from unauthorized resellers, where the risk of buying suspicious, counterfeit or modified devices is important as nothing operates under ledger security guidelines.
Security isn’t static and this incident underscores why we continuously review and strengthen our distribution and anti-tamper processes.
We are continuously improving that work now and events like this strengthen our resolution: reviewing authorized reseller controls, advancing hardware protections, and cooperating with authorities. Thanks to @SEAL_911 for their collaborative support and all their efforts.
This is an ongoing threat that doesn’t just impact Ledger, but the whole ecosystem, and we are calling others in the space to work with us on making improvements for users.
We believe in jointly working with researchers, other vendors and partners on improving industry chain-of-custody practices and anti-tamper techniques. Raising the bar on physical supply-chain integrity benefits the entire ecosystem. If you have relevant information, contact security@ledger.com.
For CryptoBilis buyers: do not initialize unused devices. If already set up, move to a new seed on a device from Ledger. If you have concerns that your device was impacted by the CryptoBilis incident, please contact Ledger Support through the official site: support.Ledger.com.
Ledger Support is available 24/7 to answer your questions and concerns.
Scammers often try to take advantage of incidents like this. Rely only on official Ledger channels. Ledger will never call you, DM you, or ask for your 24-word recovery phrase.
As the investigation continues, we are working with relevant authorities. The volume of impacted devices is limited. We know this is concerning, especially for those directly affected, and we are reaching out to impacted users.
To date, all confirmed cases related to the disclosed draining incident of Oct 9th, 2026, involve devices sold through the Southeast Asia reseller CryptoBilis. Our systems and direct sales channels remain unaffected.
We take the CryptoBilis situation seriously and are actively investigating.
We encourage impacted users to reach out to Ledger Support through official channels and file complaints with their local law enforcement authorities. As a reminder, CryptoBilis has confirmed having ceased all sales of hardware wallets.
We are reminding our authorized resellers and distributors to source products only through authorized channels and never to restock returned products.
Also, we strongly advise users not to purchase from unauthorized resellers, where the risk of buying suspicious, counterfeit or modified devices is important as nothing operates under ledger security guidelines.
Security isn’t static and this incident underscores why we continuously review and strengthen our distribution and anti-tamper processes.
We are continuously improving that work now and events like this strengthen our resolution: reviewing authorized reseller controls, advancing hardware protections, and cooperating with authorities. Thanks to @SEAL_911 for their collaborative support and all their efforts.
This is an ongoing threat that doesn’t just impact Ledger, but the whole ecosystem, and we are calling others in the space to work with us on making improvements for users.
We believe in jointly working with researchers, other vendors and partners on improving industry chain-of-custody practices and anti-tamper techniques. Raising the bar on physical supply-chain integrity benefits the entire ecosystem. If you have relevant information, contact security@ledger.com.
For CryptoBilis buyers: do not initialize unused devices. If already set up, move to a new seed on a device from Ledger. If you have concerns that your device was impacted by the CryptoBilis incident, please contact Ledger Support through the official site: support.Ledger.com.
Ledger Support is available 24/7 to answer your questions and concerns.
Scammers often try to take advantage of incidents like this. Rely only on official Ledger channels. Ledger will never call you, DM you, or ask for your 24-word recovery phrase.
509
379
2,068
806,016