Attestation Is Not Inspection
A genuine component does not establish an untampered device.
Ledger confirmed on 10 October that an affected customer’s device contained a physical implant; CryptoBilis had halted wallet sales. Its 11 October statement confined confirmed drains to that reseller and reported direct sales and Ledger systems unaffected.
Update, 15 October: In its 13 October statement, Ledger said MediaMarkt Saturn had paused store and online sales after a German implant report, with no funds reported lost in that case. That is the vendor’s account, not our audit of every store or listing.
Investigations use different standards for an observed component, a reported event and a confirmed financial consequence. Keeping those standards visible prevents a customer-support queue from becoming a public tally of proven compromises.
What the check actually establishes
Genuine Check authenticates the Secure Element. Ledger’s threat model says a physical addition can escape detection if that component remains intact. A pass does not establish physical custody.
Ledger described a separate screen-reading implant transmitting setup words over LTE, without changing the operating system, Secure Element, transactions or signatures. No verified victim count, loss total, complete affected-model list, actor or insertion point was established in the cited material.
These are different acceptance questions. The component check asks whether the expected component is present. Procurement review asks how the assembled unit reached its custodian. Evidence answering the first question cannot fill a missing answer to the second.
Keep the response tied to the seller
For CryptoBilis purchases, Ledger’s instructions distinguish unused from configured signers: do not initialise the former; move assets from the latter to a new signer and recovery phrase. Do not restore a phrase on the suspect device. Contact official support and coordinate with law enforcement before shipping or opening loss-related evidence.
Other buyers should seek manufacturer advice for their own device rather than apply a reseller-specific diagnosis indiscriminately. Never supply recovery words to an inbound caller, message or web form.
Give the delivery its own acceptance record
For an organisational purchase, retain the seller, its authorisation status at purchase, receipt date, named custodian and return or refurbishment history. Keep stock implicated in an investigation separate while the manufacturer provides a device-specific route. Record who can authorise release from that hold and what evidence they need.
Consider a hypothetical delivery that passes its component check but arrives without a traceable seller invoice. The check belongs in the acceptance record; it does not supply the missing invoice or explain an undocumented return. An administrator should preserve that distinction when asking procurement or the manufacturer to investigate, rather than repeat the software check until it feels conclusive.
Attach the component-check result and the custody decision to the same asset record, with different evidence owners. A replacement request, a support response and an internal release approval are separate outcomes. Do not close all three simply because one has arrived.
Sources: 10 October confirmation; 11 October scope; Donjon threat model; 13 October technical guidance; 13 October retailer statement.
