Ledger Confirms Implant in Hardware Wallet Sold Through CryptoBilis
Ledger confirmed an unauthorized hardware implant in a device sold by reseller CryptoBilis. The module was reportedly designed to capture the recovery phrase from the screen during initial setup and send it via LTE.
Ledger confirmed an implant in one device sold by Southeast Asian reseller CryptoBilis. The unauthorized hardware modification was reportedly designed to capture the 24-word recovery phrase from the device screen during initial setup and then send it over an LTE connection with an activated eSIM.
The company announced the incident on October 13. It emphasized that this was not a confirmed breach of its infrastructure or device firmware. According to Ledger, the implant did not alter the Secure Element, the device’s operating system, signed transactions, or cryptographic signatures.
Ledger confirmed an implant linked to CryptoBilis
Ledger says all cases of drained funds confirmed so far are linked to devices sold through CryptoBilis. The reseller has since stopped selling Ledger devices.
The attack did not involve bypassing the security chip during transaction signing. According to the description, the attacker focused on the recovery phrase—a backup credential that can be used to restore a wallet on another device. Anyone who obtains such a phrase can restore access to the assets and transfer them without any further physical access to the original hardware wallet.
The case is therefore a confirmed compromise of hardware in the distribution chain. The intact Secure Element alone did not eliminate the risk because the implant was able to capture the secret while it was being displayed to the user.
What CryptoBilis customers should do
Ledger advises customers who obtained a device through CryptoBilis not to initialize it further. If they have already set it up, they should move their assets to a new device and create a new recovery phrase.
Users should not consider the old recovery phrase safe if it was displayed on a potentially modified device. Simply leaving the assets in the original wallet does not solve the problem, since a copied phrase could allow an attacker to restore the same wallet elsewhere.
The extent of the damage has not yet been confirmed
Ledger has not disclosed the number of affected devices or the total value of the stolen assets. The estimate of $86 million comes from on-chain investigator Specter, and the company has not confirmed it so far.
It is not known how many units were physically modified, at which point in the distribution process the tampering occurred, or who was responsible. Ledger is also investigating reports of possible implants in devices sold outside CryptoBilis. However, such cases have not yet been independently confirmed.
Further information should come from the results of the forensic investigation, any findings by law enforcement authorities, and updated guidance for customers or other sellers.
Sources
- Ledger – Ledger’s official announcement confirming the implant, its method of capturing the recovery phrase, the link between confirmed losses and CryptoBilis, and the ongoing investigation.
- SecurityWeek – Independently summarizes the technical description of the implant and distinguishes the unverified $86 million estimate from amounts confirmed by Ledger.
- Decrypt – Provides details about the LTE/eSIM transmission, confirmation of the discovery in one device, and recommendations for CryptoBilis customers.
Verified and updated: October 13, 2026 15:25
