# Hidden LTE implants in Ledger wallets sold by reseller CryptoBilis stole recovery phrases · pwn.watch > Ledger devices sold through CryptoBilis, a reseller listed as authorized in Indonesia, Malaysia and the Philippines, contained hidden hardware implants that captured users' 24-word recovery phrases, Ledger said in October 2026. Its Donjon security team found the implant sits inside the enclosure, reads the phrase off the screen during setup and sends it out over LTE using an embedded eSIM. It does not modify the Secure Element, the Ledger OS, transactions or signatures, so tampered devices may still pass authenticity checks. Wallets were drained on Oct 9; Ledger has not confirmed total losses, while on-chain investigator Specter traced more than $86 million in suspected thefts. Ledger calls it a physical supply-chain attack, not a breach of its software or systems, and says its direct sales channels are unaffected. Page: https://pwn.watch/i/ledger-cryptobilis-lte-implant-recovery-phrase-theft · generated 2026-10-29T06:46:19.334Z ## Status - Severity: high · status: live · patch: partial - Product: Ledger hardware wallets (signers) sold by reseller CryptoBilis - Started: 2026-10-09 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/ledger-cryptobilis-lte-implant-recovery-phrase-theft/feed.xml - JSON Feed: https://pwn.watch/i/ledger-cryptobilis-lte-implant-recovery-phrase-theft/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/ledger-cryptobilis-lte-implant-recovery-phrase-theft.json - This file: https://pwn.watch/i/ledger-cryptobilis-lte-implant-recovery-phrase-theft/llms.txt ## Updates (newest first) - 2026-10-13: Ledger Donjon explains the implant: a separate component inside the enclosure reads the 24-word recovery phrase from the screen during setup and sends it over LTE with an embedded eSIM, without touching the Secure Element, OS, transactions or signatures. Ledger is reviewing reports of implants in other devices and locations. (https://therecord.media/ledger-cryptocurrency-wallet-implant-theft) - 2026-10-10: Ledger confirms one affected user's device contained an unauthorized hardware implant; CryptoBilis suspends sales of all hardware wallet inventory. (https://www.coindesk.com/tech/2026/10/12/ledger-says-unauthorized-implant-found-in-at-least-one-device-sold-by-cryptobilis) - 2026-10-09: Funds are drained from wallets on Ledger devices; all confirmed cases involve devices sold through Southeast Asian reseller CryptoBilis. (https://www.coindesk.com/tech/2026/10/12/ledger-says-unauthorized-implant-found-in-at-least-one-device-sold-by-cryptobilis) ## Fix brief # Security brief: Hidden LTE implants in Ledger wallets sold by reseller CryptoBilis stole recovery phrases Source: https://pwn.watch/i/ledger-cryptobilis-lte-implant-recovery-phrase-theft · status: live · severity: high · updated Oct 29, 2026, 04:03 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Ledger devices sold through CryptoBilis, a reseller listed as authorized in Indonesia, Malaysia and the Philippines, contained hidden hardware implants that captured users' 24-word recovery phrases, Ledger said in October 2026. Its Donjon security team found the implant sits inside the enclosure, reads the phrase off the screen during setup and sends it out over LTE using an embedded eSIM. It does not modify the Secure Element, the Ledger OS, transactions or signatures, so tampered devices may still pass authenticity checks. Wallets were drained on Oct 9; Ledger has not confirmed total losses, while on-chain investigator Specter traced more than $86 million in suspected thefts. Ledger calls it a physical supply-chain attack, not a breach of its software or systems, and says its direct sales channels are unaffected. Severity detail: Confirmed theft of recovery phrases and drained funds (suspected over $86M per third-party tracing); limited to devices from one reseller so far, with unverified reports elsewhere - Product: Ledger hardware wallets (signers) sold by reseller CryptoBilis ## Affected versions - Not specified in the data. Check the advisories below. ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Specific notes If a Ledger was bought from CryptoBilis and is not set up, don't initialize it and contact Ledger Support. If it is set up, move funds promptly to a new Ledger bought directly with a newly generated recovery phrase, and never enter or restore a phrase on the CryptoBilis device. Buy hardware wallets only from the manufacturer. ## Latest updates - Oct 13, 2026: Ledger Donjon explains the implant: a separate component inside the enclosure reads the 24-word recovery phrase from the screen during setup and sends it over LTE with an embedded eSIM, without touching the Secure Element, OS, transactions or signatures. Ledger is reviewing reports of implants in other devices and locations. - Oct 10, 2026: Ledger confirms one affected user's device contained an unauthorized hardware implant; CryptoBilis suspends sales of all hardware wallet inventory. - Oct 9, 2026: Funds are drained from wallets on Ledger devices; all confirmed cases involve devices sold through Southeast Asian reseller CryptoBilis. ## Write-ups & news - [Ledger says unauthorized implant found in at least one device sold by CryptoBilis](https://www.coindesk.com/tech/2026/10/12/ledger-says-unauthorized-implant-found-in-at-least-one-device-sold-by-cryptobilis) - [Ledger finds covert cellular implant stole hardware wallet recovery phrases from screens](https://www.coindesk.com/tech/2026/10/13/ledger-says-spy-chip-inside-cryptobilis-ledger-devices-transmitted-wallet-keys-over-mobile-network) - [Ledger says hardware implant in cryptocurrency wallets stole recovery phrases](https://therecord.media/ledger-cryptocurrency-wallet-implant-theft) - [Ledger Finds LTE Implant That Stole Recovery Phrases in Suspected $86M Drain](https://decrypt.co/380826/ledger-finds-lte-implant-that-stole-recovery-phrases-in-suspected-86m-drain) - [Ledger Says LTE Implants Copied CryptoBilis Wallet Recovery Phrases](https://cointelegraph.com/news/ledger-cellular-implants-wallets-sold-cryptobilis) ## Caveats Ledger is reviewing reports of implants in signers bought elsewhere, including an unverified claim of two tampered devices from European MediaMarkt stores. Trezor and OneKey also cut ties with CryptoBilis, per Cointelegraph. --- Machine-readable: https://pwn.watch/i/ledger-cryptobilis-lte-implant-recovery-phrase-theft.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.