Ledger confirms hardware implants in CryptoBilis wallets stole recovery phrases
Unauthorized circuit boards with LTE chips intercepted seed phrases from devices sold by a Southeast Asian reseller, leading to millions in losses.
Key points
- Ledger links all confirmed thefts to devices sold by reseller CryptoBilis.
- Hidden implants used microcontrollers and eSIMs to transmit recovery phrases.
- On-chain researchers estimate losses exceed $86 million to $93 million.
Ledger has confirmed that unauthorized hardware implants inside its Signer devices allowed attackers to steal cryptocurrency recovery phrases. The Paris-based company stated that all verified incidents involve wallets purchased from the Southeast Asian reseller CryptoBilis. On-chain investigators estimate the total financial damage exceeds $86 million, with some reports citing figures above $93 million.
Root cause
The compromise stems from a physical supply-chain attack rather than a software vulnerability. According to Ledger, tamperers manually soldered small circuit boards onto the device internals. These boards contained microcontrollers, antennas, LTE chips and embedded eSIM cards. The implants were positioned beneath the screen assembly, allowing them to monitor display output without altering the operating system or digital signatures.
Attack path
During the initial setup process, Ledger devices display a 24-word recovery phrase on the screen. The hidden implant detects this specific visual data. Its microcontroller decodes the words and transmits them wirelessly via LTE to the attackers. With the phrase captured, adversaries can reconstruct the wallet on separate hardware and drain funds remotely, as seen in the wave of thefts reported on 9 October 2026.
Affected versions
Ledger has not specified which hardware models were targeted. The company noted that because the implants leave the Secure Element chip intact, tampered devices can still pass official authenticity checks. All confirmed cases involve units sold through CryptoBilis in Southeast Asia, though Ledger is reviewing reports of similar issues in other regions.
Mitigation
Ledger has instructed CryptoBilis to halt all sales and shipments of its devices. The company urges customers who bought from this reseller in the last 90 days to avoid initializing the hardware. Users who have already set up their devices are advised to move assets to a new Ledger Signer with a freshly generated recovery phrase immediately.
What to do and how to stay safe: Ledger
- Check your purchase history to determine if you bought a Ledger device from CryptoBilis or other unverified resellers in the last 90 days.
- If you have an unopened device from this source, do not initialize it or enter any recovery phrases; contact Ledger support instead.
- If you have already set up a device from this reseller, transfer your assets to a new, verified hardware wallet with a new seed phrase immediately.
- Monitor your blockchain addresses for unauthorized outgoing transactions and report any suspicious activity to local law enforcement and Ledger support.
General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did Ledger confirm how much money was stolen?
Ledger has not confirmed the exact total stolen, but on-chain researchers estimate losses between $86 million and $93 million.
Can I trust my Ledger device if it passed the Genuine Check?
No, because the implants leave the internal Secure Element intact, tampered devices may still pass official authenticity verification.
Are devices sold directly by Ledger affected?
Ledger stated that its own systems and direct sales channels were not compromised, linking all confirmed cases to CryptoBilis.
