Ledger and its Donjon team say signers sold by Southeast Asian reseller CryptoBilis contained an unauthorized hardware implant, confirmed Oct 10 on one affected user's device. The implant sits inside the enclosure, reads the 24-word recovery phrase off the screen during setup and sends it over LTE via a provisioned eSIM. It does not modify the Secure Element, Ledger OS, transactions or signatures. All confirmed losses from the Oct 9 draining incident involve CryptoBilis devices, and CryptoBilis has stopped selling Ledger signers. On Oct 13, MediaMarkt Saturn paused Ledger sales after one German customer reported an implant (no loss reported). Galaxy Research's on-chain tally (Oct 16) counts about $91M taken from 474 victim addresses on bitcoin, Ethereum, Arbitrum, Polygon and TRON, which it calls a floor because it excludes BNB Chain; about 88% moved in one hour from 05:00 UTC Oct 9, and about $56.6M still sat at attacker addresses as of Oct 15. Ledger hasn't confirmed these figures. Advice: buy only from the vendor or authorized channels, and never set up or restore a seed on a CryptoBilis device. If you used one, move funds to a new device with a new seed. Lesson: a secure element doesn't protect secrets shown on the screen.