Ledger Finds LTE Implant That Stole Recovery Phrases in Suspected $86M Drain

What it is

Ledger's Donjon security team found an unauthorized hardware implant inside Ledger signers sold by the Southeast Asian reseller CryptoBilis. Ledger disclosed the incident on Friday and confirmed the implant on Saturday (October 10th) in one affected user's device. Every confirmed loss involves a CryptoBilis device. Ledger says it has not verified a drain linked to a device bought elsewhere.

How it works

The implant is a separate component inside the enclosure that reads the screen. When it detects the recovery-phrase screens, its microcontroller decodes the words and sends them over LTE through a provisioned eSIM. Per Ledger, it does not modify the Secure Element or the Ledger OS, and it does not alter transactions or signatures. The device therefore behaves normally, and the compromise happens at seed generation.

Preconditions / Affected

• The device was bought from CryptoBilis, and the recovery phrase was shown on it during setup.
• A device that was never set up has not yet exposed a phrase.

What to do

flowchart TD
    A[Where was the device bought?] -->|CryptoBilis, not set up| B[Do not set up. Contact Ledger Support]
    A -->|CryptoBilis, already set up| C[Move assets to a new device with a new phrase]
    A -->|Elsewhere| D[Optional: inspect interior using Ledger guide]
    C --> E[Never restore a phrase on a CryptoBilis device]

• CryptoBilis, unused: do not set it up. Contact Ledger Support.
• CryptoBilis, already set up: move assets promptly to a new device with a new recovery phrase. Do not enter or restore any phrase on a CryptoBilis device.
• Funds lost or tampered device held: file a report with local law enforcement. Do not open the device or send it to anyone before speaking to Ledger Support or the police.
• Bought elsewhere: you can inspect the interior using Ledger's guide. Opening a signer can damage it, so back up the recovery phrase first.
• Ledger will never call or message users directly or ask for a recovery phrase.

Caveats

• Ledger has not confirmed the number of affected users or the total loss. It says figures circulating online come from third parties it has not fully verified. That includes Specter's $86M+ trace across Ethereum, Tron and Bitcoin.
• An X user claims to have found two tampered Ledger devices bought from retail stores in Europe. This is not independently verified. Ledger says it is reviewing reports of implants in other signers and locations.
• CryptoBilis has stopped selling Ledger devices during the investigation. The Donjon is still analyzing the devices it receives, so the mechanism and scope may change.