Ledger, one of the largest hardware wallet makers, is investigating reports that wallets sold through an authorised reseller in Southeast Asia were tampered with and had a hardware implant designed to steal users’ crypto assets. The company confirmed on October 10 2026 that at least one impacted user’s device contained an “unauthorized hardware implant” hidden inside the casing.
The reseller at the centre of the investigation is CryptoBilis, an authorised Ledger reseller covering Indonesia, Malaysia and the Philippines. Users in the region reported stolen funds after setting up devices they had purchased from that reseller. Ledger said it asked CryptoBilis to pause sales and shipments on October 9 and launched an investigation.
Pseudonymous blockchain investigator Specter estimated that losses could exceed $86 million. Other reporting puts the figure in the tens of millions. Ledger has not confirmed a total loss figure or the number of affected users.
How the Implant Works
According to Ledger’s analysis, the implant is a small, separate circuit board placed inside the wallet’s enclosure, near or under the screen. It does not modify the device’s Secure Element chip, does not alter the Ledger operating system and does not change transactions or signatures that are shown on the display.
During the setup process the wallet shows the user a 24-word recovery phrase on the screen. When the implant detects those screens, its microcontroller decodes the words and transmits them over LTE using a provisioned eSIM. Anyone who captures that phrase can recreate the user’s private keys elsewhere and spend the funds without ever touching the original device.
This is why the implant is so dangerous: it bypasses the Secure Element entirely. The Secure Element never sees the implant. The keys remain valid on the blockchain and the theft happens when the thief uses the captured phrase on their own device.
What a Recovery Phrase Is
A hardware wallet is a device that stores the private keys that prove ownership of cryptocurrency. Those keys are generated from a list of 24 words, shown once during setup. That list of words is the recovery phrase.
Anyone who knows those 24 words can recreate the private keys on another device and take control of the assets. The phrase is the wallet. The device is just a tool for keeping it safe and signing transactions.
A recovery phrase should always be generated on the device itself, shown on the device screen, and written down by the user on paper or metal. It should never be typed into a computer, stored in a photo, or shared with anyone. The whole point of a hardware wallet is that the phrase never touches an internet-connected device.
What to Do Now
If you bought a Ledger device from CryptoBilis in the last 90 days, take the following steps immediately:
- Do not initialise an unused device bought from that reseller. If you have not set it up yet, do not do so.
- If already set up, generate a new recovery seed on a Ledger device purchased from a trusted source and move your funds to the new wallet.
- Never accept a pre-written recovery phrase. A legitimate device generates its own phrase during setup. If your device came with a phrase already printed on a card or sheet, treat it as compromised.
- Generate the seed on the device yourself and write it down privately. Do not let anyone else see it.
- Run Ledger’s Genuine Check, but understand its limits (see below).
- Treat second-hand or unclear-custody devices as compromised unless you fully trust the source.
- Watch only official Ledger channels and ignore unsolicited offers to recover lost funds. These are almost always scams.
Ledger said it will never call, message directly, or ask for the 24-word recovery phrase. The company urged anyone with information to contact its bounty programme and to reach support only through support.ledger.com.
CryptoBilis posted an alert on its website: “Your recovery phrase must be generated by your device when you set it up, and written down by you.” It also warned: “If your device came with a recovery phrase already printed or written on a card or sheet, or if anyone other than you has seen your recovery phrase, treat your wallet as unsafe.” The reseller added: “Never share your recovery phrase or PIN with anyone. No one from CryptoBilis or Ledger will ever ask for them. Be careful of anyone who offers to recover lost funds; these offers are almost always scams.”
What Genuine Check Can and Cannot Do
Ledger’s Genuine Check is a software test that proves the Secure Element chip is authentic and running Ledger’s genuine firmware. It is a useful tool, but it has a clear limitation.
Because the implant sits alongside the original Secure Element and does not modify it, Genuine Check will pass the device even when an implant is present. The chip is still the real chip. The implant is an extra component that the check is not designed to detect.
This means a passing Genuine Check does not guarantee the device is free of unauthorised physical modifications. Only a physical inspection inside the enclosure can identify the implant.
Why the Security Chip Was Bypassed
The Secure Element is a certified chip designed to protect private keys. It ensures that keys cannot be extracted from the device and that transactions are displayed on screen for user verification. The chip is the core of a hardware wallet’s security.
The implant does not attack the chip. It watches the screen during setup, reads the recovery phrase when it is displayed, and sends it out via LTE. Because the chip is still doing its job — protecting the keys inside the device — there is nothing for the security check to flag. The leak happens at the moment the phrase is shown to the user, before the keys are even used.
This is a supply-chain attack: the device was modified before it reached the buyer. The attacker does not need to break the chip. They just need to capture the phrase as it appears on screen.
Crypto Disclosure
This article reports events as of October 14 2026. Crypto assets are volatile and can lose value. This article is not financial or investment advice. Readers should verify current information with Ledger’s official channels before making decisions.
Sources
- The Hacker News – Ledger Finds Unauthorized Hardware Implant in Reseller-Sold Wallets
- Decrypt – Ledger Says All Confirmed Cases in Suspected $87M Drain Tied to Reseller CryptoBilis
- The Defiant – Ledger Says CryptoBilis Sold Wallet Implants Transmit Recovery Phrases Over LTE
- ThreatWire – Ledger CryptoBilis Tampered Wallets Seed Theft
- TokenPost – Ledger Investigates Tampered Wallets Sold Through CryptoBilis
