Ledger hardware wallet breach exposes LTE implant stealing recovery phrases

What it is

Ledger's Donjon team confirmed a hidden hardware implant inside a Ledger wallet sold by the Malaysia-based reseller CryptoBilis, which operates across Southeast Asia. Ledger confirmed it on October 10, 2026, in one affected user's device. The page, citing BleepingComputer, says the investigation began October 9, when Ledger asked the reseller to halt sales and shipments. CryptoBilis has since stopped selling Ledger devices.

How it works

The implant is separate hardware inside the enclosure. It reads the device display, and when a 24-word recovery phrase is shown, its microcontroller decodes the words and sends them over LTE through a provisioned eSIM. Ledger says the Secure Element, the OS, transactions and signatures are unchanged. Signature checks and transaction review on the device therefore would not reveal the tampering. The compromise is at the supply-chain and physical level.

Preconditions / Affected

• The device was bought from CryptoBilis. Ledger says all confirmed losses involve CryptoBilis purchases.
• The phrase was displayed on the device during setup, which is when the implant can capture it.
• The page does not say how many devices are affected. Ledger calls the volume "limited."

What to do

Ledger's guidance, by situation:

• Device not yet set up: leave it unused and contact Ledger Support.
• Device already set up: promptly move assets to a new device with a new recovery phrase. Moving funds to a new address on the same phrase does not help, because the phrase is the compromised secret.
• Never enter or restore a recovery phrase on a CryptoBilis-bought device.
• Funds lost or a tampered device in hand: contact Ledger Support and file a report with local law enforcement.
• Do not open the device or send it to anyone before speaking with support or police. This preserves evidence.

For anyone who buys hardware wallets for a team or fleet, this means checking whether any units came from this reseller.

Caveats

• The $86M+ figure across Ethereum, Tron and Bitcoin is onchain investigator Specter's tally of suspected thefts. It is not a loss total confirmed by Ledger, and the page does not say how much is tied to this implant.
• Ledger says it is working with authorities to identify the perpetrator. The page does not say how the implants were installed or where in the chain, nor whether other resellers are affected.
• The page was produced with AI assistance. Its facts are secondhand, relayed from Decrypt and BleepingComputer.