Ledger confirms hidden implant in wallets sold by CryptoBilis

Ledger asked CryptoBilis to pause sales and shipments on Oct. 9, 2026. CryptoBilis, a reseller operating in Indonesia, Malaysia, and the Philippines, sold the Ledger devices that were later found to contain the hidden implant. CryptoBilis ceased selling Ledger hardware wallets after Ledger requested a pause pending the investigation.

Ledger said the implant reads recovery phrase (24‑word backup that restores the wallet) from wallet screen and sends it over LTE (a cellular network) through eSIM (an embedded SIM card). The implant contains a hidden circuit board equipped with cellular components that can capture the recovery phrase as it appears on the wallet screen. Such capture defeats the wallet’s purpose of keeping private keys offline and isolated from internet‑connected systems.

Ledger advised customers who bought from CryptoBilis in the prior 90 days not to initialize the devices and to move assets to a new wallet with a fresh recovery phrase. Ledger advises users never to type a recovery phrase into a website, app or online form and to download software only from its official website.

Ledger’s Oct. 11, 2026 update noted that customers in Southeast Asia began reporting drained wallets three days prior and that all confirmed cases of the Oct. 9, 2026 draining incident involve devices sold through CryptoBilis. Trezor announced that reseller authorizations will expire on Jan. 1, 2027 and will stop shipping new stock to partners after that date as a precaution after the Ledger supply‑chain incident.

Ledger stated it has not validated the loss estimates and has confirmed only one device containing the implant to date. Ledger’s Donjon team stated that the CryptoBilis‑sold wallets included an unauthorized component that captures the recovery phrase as it appears on screen and sends it over an LTE connection. The Donjon team also said the implant does not alter the secure‑element chip (a tamper‑resistant microprocessor that stores private keys) or the device’s operating system (the software that runs the device).

Blockchain analysts estimated losses between roughly $72 million and $93.4 million, based on varying numbers of implicated cryptocurrency addresses. Yfarmx estimated suspected losses at $93.4 million across 471 addresses. Bitquery estimated about $92.9 million across 311 addresses.

Researcher Specter said the losses surpassed $86 million. On‑chain investigator tanuki42 identified more than $72 million sent to addresses believed to be tied to the thefts. Reports cite losses of either $92 million or $93 million.

Trezor said it decided to reduce the number of resellers following recent supply‑chain incidents to more effectively check those they work with. Ledger and Trezor have each warned buyers against unauthorized sellers. Supply‑chain tampering can allow a hidden component inside a hardware wallet to capture the recovery phrase, defeating the wallet’s purpose of keeping private keys offline.

Criminals can seize a device during shipping, alter its internal parts, and re‑seal the box so it looks untouched. Experts have shown lab‑based attacks that mimic this method on hardware wallets before, but actual incidents leading to large‑scale money loss remain rare. Ledger’s reputation rests on its use of secure‑element chips and firmware checks that aim to spot tampering before a wallet ships to users.

For years Ledger has advised customers to buy only from the firm itself or its approved partners, avoiding third‑party sellers whose background is unclear. The incident highlights the danger of a reseller handing out wallets that someone modified before they reached buyers. Ledger says its probe into the issue remains active, according to reports on the case.

Ledger explained it is working to find out how many devices were hit, who altered them, and what safeguards to add. Supply chain attacks are harder to catch, prove, and fix at scale; you cannot remotely de‑solder a rogue circuit board. Loading a recovered seed that was already captured onto a fresh wallet won’t help, because the seed was exposed when it was first created.

Following best practices like keeping the phrase offline and not sharing it cannot prevent loss if attackers tampered with the device before arrival; Ledger advises users to buy only from official sources and to never enter recovery phrases into websites, apps, or online forms.