A hidden component—not altered wallet software—is at the center of the Ledger hardware wallet breach involving devices sold by CryptoBilis. Ledger’s Donjon security team found an implant that reads recovery phrases from the screen and sends them over a cellular connection, while leaving the device’s operating system and transactions unchanged.
Key takeaways
Confirmed losses involve wallets purchased through CryptoBilis.
The implant sends recovery words over LTE.
Specter traced more than $86 million in suspected thefts.
CryptoBilis has suspended Ledger device sales.
According to Decrypt, Ledger confirmed the implant inside one affected user’s device on October 10, 2026. BleepingComputer reported that the investigation began on October 9, when Ledger asked the Malaysia-based reseller to halt sales and shipments.
How the Ledger hardware wallet breach captured recovery phrases
The unauthorized implant sits inside the wallet’s enclosure and reads its display, Ledger said. When the screen shows a 24-word recovery phrase, the implant’s microcontroller decodes the words and transmits them over LTE through a provisioned eSIM.
The discovery concerns wallets distributed by CryptoBilis, a retailer operating across Southeast Asia. Ledger confirmed physical tampering in an affected device as it investigated reports of missing cryptocurrency.
Wallet software and transactions remained unchanged
Ledger said the implant is separate hardware that does not change the device’s Secure Element or operating system. It also leaves transactions and signatures unaltered.
All confirmed losses in the Ledger hardware wallet breach involve CryptoBilis purchases, according to Ledger. BleepingComputer reported that the company described the affected volume as “limited” and said it was working with authorities to identify the perpetrator.
Specter traces more than $86 million in suspected thefts
According to the primary report, onchain investigator Specter tracked over $86 million in suspected thefts spanning Ethereum, Tron and Bitcoin. That figure represents suspected thefts traced by the investigator, rather than a confirmed loss total from Ledger.
CryptoBilis confirmed that it stopped selling Ledger devices while the investigation continues.
Ledger’s instructions for CryptoBilis buyers
Ledger advises buyers who have not yet set up a CryptoBilis-purchased device to leave it unused and contact Ledger Support. Those who already completed setup should promptly transfer their assets to a new device using a new recovery phrase.
Users should never enter or restore a recovery phrase on a device bought from CryptoBilis. Anyone who lost funds or holds a tampered device should contact support and file a report with local law enforcement.
Ledger also instructed affected users not to open the device or send it to anyone before speaking with support or police.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.