Rival hardware wallet maker Ledger confirmed that devices sold through Southeast Asian reseller CryptoBilis contained an unauthorized hardware implant that intercepted 24-word recovery phrases.