Last week, I wrote about breaking news of reported losses involving Ledger devices. We now have more details. Ledger says an implant inside devices sold through Southeast Asian reseller CryptoBilis read the recovery phrase as it appeared on the screen during setup and transmitted it over LTE using an eSIM. The secure element and operating system remained intact. That is why a passing Genuine Check could establish that the secure element was genuine while missing a component spying on the screen. It’s a hell of a limitation to discover after people have trusted that check with their life savings.
There is also a reported implant in a device bought in Germany. Ledger says no funds have been reported lost in that case yet, and it has not verified a drain involving a device bought outside CryptoBilis. Reports can take time to surface. Someone who bought bitcoin to hold for years may have the device in a safe and no reason to check Ledger’s X account this week.
If you bought from CryptoBilis and already set up the device, I would treat that recovery phrase as exposed and move promptly to a wallet with a new recovery phrase generated on a different device. My preference would be a carefully set up SeedSigner with entropy you generate yourself. If you cannot get that done promptly, a reputable exchange or a newly created BlueWallet hot wallet could be a temporary stopgap, with the custody or online-device risks that entails. Verify the destination address and, where practical, make a small test transfer. Never restore the suspect phrase into the replacement wallet or type it into a website.
Longer term, I increasingly favor independently generated entropy and multisig for meaningful balances. SeedSigner is one route; collaborative custody through providers like Unchained is another. Bitkey may offer more manageable trade-offs for someone who will not maintain a technical multisig setup. Bitcoin lets us remove trusted third parties from the custody of our money, and that is an extraordinary thing in a world built on inflation and counterparties. It also puts real responsibility on us. If you are not ready to take that on, you may not be ready for self-custody yet. Once you are, I highly recommend it. It can change your life.