Ledger has confirmed that hardware wallets sold by Southeast Asian reseller CryptoBilis were tampered with before reaching buyers. According to the company's Donjon security team, an unauthorized implant hidden inside the device enclosure reads the data shown on the screen; when it detects the setup screens displaying the 24-word recovery phrase, its microcontroller decodes the words and transmits them over LTE using a provisioned eSIM. The implant is a separate component — it does not modify the Secure Element or the Ledger operating system, and it does not alter transactions or signatures, which is why the devices passed casual inspection.
Ledger said it has not confirmed the total number of affected users or the total value lost, noting that figures circulating online come from third parties. Onchain researchers estimated losses of up to roughly $86-102 million across more than 300 wallets, and Tether froze $10 million in USDT tied to the theft. Ledger has asked CryptoBilis to pause all sales and shipments while its security team examines recovered hardware, and says the investigation is ongoing to determine where in the distribution chain the tampering occurred.
The fallout is widening beyond Southeast Asia. On October 13, MediaMarkt Saturn stopped selling Ledger devices in its physical stores and online after a customer in Germany reported an implant in one device, with no fund losses reported in that case. Separately, a former Mt. Gox CEO claimed to have found a similar implant in a Ledger Flex bought at Singapore Airport. OneKey and Trezor cut ties with CryptoBilis the same week, and Trezor said it is reducing its number of resellers as a precaution.
Why it matters
This attack shatters the one assumption hardware wallets were supposed to guarantee: that the device in your hand is exactly what the factory made. A covert cellular implant that reads your seed phrase off the screen and exfiltrates it over LTE turns "self-custody" into a surveillance device — and it bypassed every software check, because the software was never touched. The uncomfortable lesson is that the crypto supply chain now faces the same adversary model as intelligence agencies: if you can't prove chain of custody from the factory to your doorstep, a tamper-evident seal isn't enough. Expect hardware wallet makers to move toward factory-direct-only sales and verifiable hardware attestation — because reseller trust is now a luxury nobody can afford.
Source: CoinDesk — Ledger Finds Covert Cellular Implant Stole Hardware Wallet Recovery Phrases From Screens (October 13, 2026). Summary rewritten by VCTRIA.
