A Ledger device can pass Genuine Check and still be unsafe to use if someone has added hardware that watches the recovery phrase during setup.
Galaxy Research’s October 16 review links that hardware attack to coordinated cryptocurrency withdrawals. It adds a detailed on-chain account of the losses to earlier disclosures from Ledger and independent researchers about how the implants operated.
What affected owners need to know
Replacing the hardware is not enough if the recovery phrase was exposed. That phrase can restore the same wallet elsewhere. The required remedy is a newly generated phrase on trusted hardware, followed by a transfer of assets to addresses derived from it.
In brief
- Genuine Check authenticates the Secure Element; it does not inspect every component inside the device.
- The implant captured recovery words displayed during setup and sent them over its own cellular connection.
- Galaxy estimates that at least $91 million left 474 addresses within the scope of its research.
- A new PIN, factory reset or clean replacement device cannot revoke a recovery phrase an attacker already has.
A passed Genuine Check did not mean the device was untouched
Ledger’s Genuine Check is a cryptographic authentication process. Ledger’s server sends a challenge, and the device’s Secure Element responds with a signature that can be verified against Ledger’s manufacturing attestation.
That establishes that the responding Secure Element is genuine. The key used for this device check is separate from the owner’s wallet recovery phrase.
The distinction explains how the affected devices could pass the check. The attacker did not need to extract a secret from the protected chip or forge its response. The original Secure Element remained in place while separate hardware inside the device observed information reaching the screen.
Ledger Donjon’s documentation sets out that limitation directly: Genuine Check cannot detect an unauthorized physical modification, including a spying implant, when the original Secure Element remains intact.
A successful result is still useful: it verifies the component designed to answer the challenge. It is not a physical inspection of the enclosure or a guarantee that nothing else has been added inside it.
The implant watched the display, then used its own radio
Ledger’s earlier confirmation of an implant in an affected device established physical tampering. Its subsequent explanation described a component that captured the 24-word recovery phrase during setup and transmitted it over LTE using an embedded SIM.
Tibane Labs’ examination of Nano X specimens provides more detail on the technique. Added circuitry monitored the screen’s data lines, reconstructed the displayed words and used a cellular modem to transmit them. It did not need a camera or the connected computer’s internet connection.
That matters because the recovery phrase is the wallet’s master backup. Once an attacker has a usable copy, they can restore the wallet in another environment and sign transactions there. The original Ledger device does not need to approve the later theft.
The specimens Tibane examined also show why a quick visual comparison is not a reliable safety test. One design concealed components beneath the display while retaining the original battery. Loose wiring, an unusually small battery or an altered exterior therefore cannot be treated as universal warning signs.
Those examinations document the implant method, not every device involved in the CryptoBilis incident. They do not establish that every compromised wallet used the same design or entered distribution through the same route.
A copied phrase can become a multi-chain loss
Galaxy estimates that approximately $91 million left 474 addresses across Bitcoin, Ethereum, Arbitrum, Polygon and TRON. Its analysis excluded BNB Chain, which other trackers included, so Galaxy presents its figure as a floor rather than a complete incident total.
The Bitcoin withdrawals began on October 7. Across the assets Galaxy examined, about 88% of the value, roughly $80 million, moved during one hour beginning at 05:00 UTC on October 9.
That timing supports the view that the withdrawals were coordinated rather than unrelated losses. It does not show when every recovery phrase was captured, how long the attackers held the information or whether each affected owner used the same implant version.
The 474-address figure also is not a count of people, wallets or physically examined devices. A single owner may control multiple addresses, while blockchain tracing alone cannot establish which hardware was used for each wallet. The $91 million estimate is Galaxy’s on-chain assessment, not a Ledger-confirmed total or a compensation commitment.
Authorised resale reduced risk, but did not prove a device was untouched
In its October 15 response, Ledger said attackers bought genuine devices, fitted hidden components and returned them to distribution through resellers in Southeast Asia. The company said its chip, operating system and servers were not compromised.
Ledger also said it requested sales suspensions from authorized resellers and distributors in Southeast Asia and Hong Kong. Its teams inspected devices bought from stores and warehouse samples, including checks in Germany, and reported that the units examined were clean.
The company has reiterated that returned devices must never be resold, even if they appear new and unopened. Its updated requirements tell retailers to keep stock away from shelves and display areas, hand it to buyers only at purchase, and report unusual products promptly.
Those controls reduce the chance that a handled device reaches a buyer. They also explain why “buy only from an authorized reseller” cannot be the whole answer: CryptoBilis had itself been listed as authorized.
Ledger’s purchasing guidance separates two risks that are often conflated. Genuine Check remains relevant when assessing a counterfeit device; physical custody and distribution controls address a genuine device modified after it left the factory.
What does and does not protect a wallet after phrase exposure
New PIN
Protects physical access to the device. It does not replace the private keys derived from an exposed phrase.
Factory reset
Does not remove a physical implant or erase words that may already have been transmitted.
Old phrase on new hardware
Recreates the same wallet, leaving an attacker’s copy of the phrase valid.
New phrase on trusted hardware
Creates new keys and new addresses to which assets can be moved.
Ledger’s instructions for CryptoBilis buyers draw the same dividing line. Its October 13 investigation update told buyers not to set up unused units or enter an existing recovery phrase into them. Owners who had already initialized a device were advised to move assets to a new signer with a new recovery phrase.
For someone who suspects their phrase was exposed, the priority is to secure the wallet—not to prove whether the hardware has been altered. Fresh keys must be generated on trusted hardware, then assets must be sent to addresses controlled by those new keys. The suspect device should not generate the replacement wallet.
People who have lost funds or believe they hold a modified device should contact Ledger through its official support channels and coordinate with law enforcement before opening or shipping the hardware. Preserving a device may matter to an investigation, but informal disassembly is neither a complete safety test nor a substitute for moving funds secured by an exposed phrase.
This article is provided for informational purposes only and does not constitute financial or investment advice. Follow current manufacturer guidance when handling a potentially compromised device.
Kosta has reported on cryptocurrency markets and blockchain infrastructure since 2020, bringing over six years of hands-on experience in the crypto industry built through daily tracking of markets, trends, and emerging blockchain developments. Specializing in Bitcoin on-chain analysis, institutional ETF flows, and digital asset price action, his work at Coindoo has been cited by other news agencies and consistently covers market developments with a focus on data-driven reporting across Bitcoin, Ethereum, Solana, and XRP.
Over the years, Kosta has contributed to multiple crypto media outlets in different regions, authoring over 6,000 articles across the sector. His reporting spans cryptocurrency markets and the broader fintech industry, tracking not only price action but also the technological and regulatory forces shaping the ecosystem.
To support his analysis, Kosta actively leverages on-chain data and metrics from leading platforms such as Santiment, Glassnode, and CryptoQuant, enabling deeper, evidence-based market insights. He believes in the power of transparency and the data that underpins the blockchain ecosystem.
His academic background in Marketing Management from Denmark further complements his analytical approach, adding a strong understanding of communication strategy and content positioning to his work.
Be the first to comment