Tampered Ledger devices sold via CryptoBilis leaked recovery phrases
Ledger said covert chips in some Ledger wallets sold by Southeast Asian reseller CryptoBilis captured users' recovery phrases and sent them out over LTE; researchers estimate up to $93.2 million stolen.
- First reported
- Reports
- 1
Source: coindesk.com · published
What happened
CoinDesk reported on October 13, 2026 that Ledger said covert hardware implanted in some Ledger devices sold by Southeast Asian reseller CryptoBilis read users' 24-word recovery phrases from the device screen and transmitted them over a mobile network using an eSIM.
Ledger called it a physical supply-chain attack, not a breach of its software or systems, and said every confirmed loss in the October 9 incident involved a device sold by CryptoBilis. It is still investigating where tampering happened. Ledger has not confirmed totals; onchain researchers estimated losses of up to $93.2 million across more than 300 wallets, and Tether froze $10 million in USDT tied to the theft.
How the scam works
The implant sat inside the device case. When the user set up the wallet and the screen showed the recovery phrase, the implant's microcontroller decoded the words and sent them out. With the phrase, an attacker can rebuild the wallet elsewhere and move funds without the device. Ledger said the implant did not change the secure element, the operating system, or any transactions.
CryptoBilis has stopped selling Ledger signers. CoinDesk also reported that MediaMarkt Saturn stopped selling Ledger devices after a customer in Germany reported a suspected implant, and that Ledger is examining reports of implants in other devices and locations.
Source
CoinDesk, "Ledger says 'spy' chip inside CryptoBilis Ledger devices transmitted wallet keys over mobile network" (October 13, 2026).
Red flags
- Hardware wallets bought from third-party resellers rather than the manufacturer.
- Signs of tampering on the device or its packaging.
- A device that arrives with a recovery phrase already set, or prompts you to use one provided.
If you were targeted
- 1If you bought a Ledger from CryptoBilis and have not set it up, do not initialise it.
- 2If you used one, move your assets to a new device with a newly generated recovery phrase.
- 3Buy hardware wallets directly from the manufacturer.
- 4Report losses to your national cybercrime agency (in the US, ic3.gov).