Ledger said covert hardware inside some wallet devices sold by Southeast Asian reseller CryptoBilis read users' 24-word recovery phrases from screens and transmitted them to an attacker. Onchain researchers estimated that more than 300 wallets lost up to $93.2 million. Ledger said the implant did not modify the devices' secure Element chips, operating systems, transactions or signatures. The incident was a physical supply chain attack rather than a breach of Ledger's software or internal systems.