Hidden LTE implants in Ledger wallets sold by reseller CryptoBilis stole recovery phrases ยท updates https://pwn.watch/i/ledger-cryptobilis-lte-implant-recovery-phrase-theft Ledger devices sold through CryptoBilis, a reseller listed as authorized in Indonesia, Malaysia and the Philippines, contained hidden hardware implants that captured users' 24-word recovery phrases, Ledger said in October 2026. Its Donjon security team found the implant sits inside the enclosure, reads the phrase off the screen during setup and sends it out over LTE using an embedded eSIM. It does not modify the Secure Element, the Ledger OS, transactions or signatures, so tampered devices may still pass authenticity checks. Wallets were drained on Oct 9; Ledger has not confirmed total losses, while on-chain investigator Specter traced more than $86 million in suspected thefts. Ledger calls it a physical supply-chain attack, not a breach of its software or systems, and says its direct sales channels are unaffected. en Tue, 13 Oct 2026 00:00:00 GMT Hidden LTE implants in Ledger wallets sold by reseller CryptoBilis stole recovery phrases: Ledger Donjon explains the implant: a separate component inside the enclosure reads the 24-word recovery phrase from the screen during setup and sends it over LTE with an embedded eSIM, without touching the Secure Element, OS, transactions or signatures. Ledger is reviewing reports of implants in other devices and locations. https://pwn.watch/i/ledger-cryptobilis-lte-implant-recovery-phrase-theft https://pwn.watch/i/ledger-cryptobilis-lte-implant-recovery-phrase-theft#2026-10-13-36c82df6 Tue, 13 Oct 2026 00:00:00 GMT high <p><a href="https://therecord.media/ledger-cryptocurrency-wallet-implant-theft">Source</a></p> Hidden LTE implants in Ledger wallets sold by reseller CryptoBilis stole recovery phrases: Ledger confirms one affected user's device contained an unauthorized hardware implant; CryptoBilis suspends sales of all hardware wallet inventory. https://pwn.watch/i/ledger-cryptobilis-lte-implant-recovery-phrase-theft https://pwn.watch/i/ledger-cryptobilis-lte-implant-recovery-phrase-theft#2026-10-10-d609364c Sat, 10 Oct 2026 00:00:00 GMT high <p><a href="https://www.coindesk.com/tech/2026/10/12/ledger-says-unauthorized-implant-found-in-at-least-one-device-sold-by-cryptobilis">Source</a></p> Hidden LTE implants in Ledger wallets sold by reseller CryptoBilis stole recovery phrases: Funds are drained from wallets on Ledger devices; all confirmed cases involve devices sold through Southeast Asian reseller CryptoBilis. https://pwn.watch/i/ledger-cryptobilis-lte-implant-recovery-phrase-theft https://pwn.watch/i/ledger-cryptobilis-lte-implant-recovery-phrase-theft#2026-10-09-793e1472 Fri, 09 Oct 2026 00:00:00 GMT high <p><a href="https://www.coindesk.com/tech/2026/10/12/ledger-says-unauthorized-implant-found-in-at-least-one-device-sold-by-cryptobilis">Source</a></p>