Genuine Check Cannot Prove Hardware History
A genuine component does not establish an untampered device.
The fund-draining incident was disclosed on 9 October. Ledger Support confirmed on 10 October that one affected user’s device contained an unauthorised hardware implant. It said CryptoBilis had stopped wallet sales as a precaution.
Ledger’s 11 October update says all confirmed cases involved devices sold through CryptoBilis and the volume was limited. Ledger says its systems and direct sales channels remain unaffected.
What the check proves, and what it does not
Ledger Donjon explains that Secure Element attestation proves the original component is genuine. Genuine Check cannot detect an added physical implant when the original Secure Element remains intact, and it does not verify the device’s physical chain of custody.
In its 13 October explanation, Ledger says the implant reads setup words from the screen and sends them through a mobile connection.
This is a boundary between component authentication and whole-device history. A successful software check is useful, but it is not evidence that nobody opened, altered or resold the physical unit after manufacture.
The vendor’s advice is reseller-specific
Ledger’s 13 October update tells CryptoBilis buyers not to initialise an unused signer. For one already configured, it directs them to move assets promptly to a replacement signer with a new recovery phrase, and not to restore an existing phrase on the suspect device. It recommends official support and suitable law-enforcement coordination before shipping or opening a device associated with a loss.
No cited source names an affected model list, device count, loss total, actor or insertion point. Do not turn this bounded reseller incident into a claim about every Ledger device or sales channel.
Procurement history is part of acceptance
For organisational purchases, record the seller, authorisation status at purchase, receipt date, custodian and any return or refurbishment history. Quarantine stock from a reseller under investigation until the manufacturer supplies an approved path.
Make physical inspection and chain-of-custody review separate acceptance steps from firmware and component attestation. Keep support conversations in verified channels, and reject any caller or message that asks for recovery material.
Sources: Ledger Support; Ledger; Ledger Donjon; Ledger’s 13 October update.
