Hidden LTE implants in Ledger wallets sold by reseller CryptoBilis stole recovery phrases
Ledger hardware wallets (signers) sold by reseller CryptoBilis
Ledger devices sold through CryptoBilis, a reseller listed as authorized in Indonesia, Malaysia and the Philippines, contained hidden hardware implants that captured users' 24-word recovery phrases, Ledger said in October 2026. Its Donjon security team found the implant sits inside the enclosure, reads the phrase off the screen during setup and sends it out over LTE using an embedded eSIM. It does not modify the Secure Element, the Ledger OS, transactions or signatures, so tampered devices may still pass authenticity checks. Wallets were drained on Oct 9; Ledger has not confirmed total losses, while on-chain investigator Specter traced more than $86 million in suspected thefts. Ledger calls it a physical supply-chain attack, not a breach of its software or systems, and says its direct sales channels are unaffected.
Why this severity: Confirmed theft of recovery phrases and drained funds (suspected over $86M per third-party tracing); limited to devices from one reseller so far, with unverified reports elsewhere
- Started
- Oct 9, 2026
Affected
Not published yet
Fixed in
No fixed release yet
Timeline3
Ledger Donjon explains the implant: a separate component inside the enclosure reads the 24-word recovery phrase from the screen during setup and sends it over LTE with an embedded eSIM, without touching the Secure Element, OS, transactions or signatures. Ledger is reviewing reports of implants in other devices and locations.
Ledger confirms one affected user's device contained an unauthorized hardware implant; CryptoBilis suspends sales of all hardware wallet inventory.
Funds are drained from wallets on Ledger devices; all confirmed cases involve devices sold through Southeast Asian reseller CryptoBilis.
News & write-ups5
- Ledger says unauthorized implant found in at least one device sold by CryptoBilisCoinDesk · Oct 12, 2026
- Ledger finds covert cellular implant stole hardware wallet recovery phrases from screensCoinDesk · Oct 13, 2026
- Ledger says hardware implant in cryptocurrency wallets stole recovery phrasesThe Record · Oct 13, 2026
- Ledger Finds LTE Implant That Stole Recovery Phrases in Suspected $86M DrainDecrypt · Oct 13, 2026
- Ledger Says LTE Implants Copied CryptoBilis Wallet Recovery PhrasesCointelegraph · Oct 13, 2026
Notes & caveats
Ledger is reviewing reports of implants in signers bought elsewhere, including an unverified claim of two tampered devices from European MediaMarkt stores. Trezor and OneKey also cut ties with CryptoBilis, per Cointelegraph.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
