Attackers have found a way to steal cryptocurrency from genuine Ledger hardware wallets without compromising the devices’ Secure Element or modifying their operating systems. Instead, they concealed cellular-enabled surveillance hardware inside the wallets, allowing attackers to capture recovery phrases directly from the devices’ screens.
Ledger confirmed the discovery in October 2026 while investigating cryptocurrency thefts involving devices distributed through CryptoBilis, a hardware wallet reseller operating in Southeast Asia.
The malicious implants reportedly intercepted the 24-word recovery phrases displayed during wallet initialization and transmitted them to attackers over an LTE cellular connection using embedded eSIM technology.
Once obtained, a recovery phrase can be used to recreate a cryptocurrency wallet on another device, giving an attacker access to its assets without possessing the original hardware wallet.
The attack represents a particularly dangerous form of supply-chain compromise because the affected devices could remain cryptographically genuine while containing additional hardware designed to steal their most sensitive information.
How the hardware implant intercepted recovery phrases
Ledger hardware wallets protect cryptocurrency private keys using a dedicated Secure Element, a security chip designed to isolate sensitive cryptographic operations from potentially compromised computers and smartphones.
During initial setup, a Ledger device generates and displays a 24-word recovery phrase. This phrase serves as the backup from which the wallet’s private keys can be restored.
The security model depends on keeping those words private. Users are instructed to record them offline and never enter them into websites, applications or unsolicited recovery prompts.
The newly identified attack bypassed those precautions by targeting the device’s physical display system.
According to Ledger’s October 13 technical explanation, the unauthorized implant monitored information shown on the screen. When it detected the recovery phrase during setup, an embedded microcontroller decoded the words and transmitted them through a cellular modem.
The attack involved several components:
- Display interception: The implant monitored information presented on the hardware wallet’s screen.
- Microcontroller: A separate processor identified and decoded the recovery words.
- Cellular modem: An LTE module provided a communications channel independent of the user’s computer.
- Embedded SIM: An eSIM enabled the implant to communicate over a mobile network.
- Concealed antenna: A thin antenna wire supported wireless transmission from inside the device enclosure.
Crucially, the implant did not need to extract private keys from the Secure Element. Capturing the recovery phrase provided another route to the same funds.
Ledger said the malicious hardware operated separately from the legitimate security components and did not alter the device’s operating system, transaction signatures or normal cryptographic operations.
Researchers identify multiple implant designs
Independent analysis by Tibane Labs documented modified Ledger Nano X devices containing unauthorized electronic components.
Researchers obtained suspicious devices through Japanese online marketplaces, including units associated with sellers shipping products from Malaysia.
The investigation identified multiple implant configurations, indicating that the attack was not limited to a single improvised modification.
In one design, attackers replaced the wallet’s original battery with a smaller battery to create space for the additional circuitry.
The modified device contained an STM32G431KBU6 microcontroller, an embedded SIM and a cellular communications module.
Another design concealed its electronics beneath the device’s display, using space normally occupied by protective padding. This configuration retained the original battery and incorporated a purpose-built flexible printed circuit board.
Researchers also observed that identifying markings had been removed from some electronic components, making their origins more difficult to establish.
The progression from manually assembled components to a manufactured flexible circuit board is significant.
It suggests the attackers invested in producing hardware that could fit more precisely inside legitimate wallet enclosures, potentially making physical tampering harder to notice during ordinary use.
However, the existence of multiple implant designs does not establish how many modified devices were distributed or whether every variant was used in confirmed cryptocurrency thefts.
Why Ledger’s Genuine Check could not detect the implant
One of the most important findings concerns the limitations of hardware authenticity checks.
Ledger provides a cryptographic verification mechanism known as Genuine Check, which authenticates a device’s Secure Element when it communicates with official Ledger software.
The process uses cryptographic signatures to establish that the device contains a legitimate Secure Element rather than a counterfeit security chip.
However, the mechanism does not verify every physical component inside the enclosure.
In its official device genuineness documentation, Ledger explicitly acknowledges that Genuine Check cannot identify unauthorized hardware modifications when the original Secure Element remains intact.
That distinction explains how a compromised device could potentially pass authenticity verification while still exposing its recovery phrase.
The attacker was not attempting to forge Ledger’s cryptographic identity. Instead, the malicious components operated alongside authentic hardware.
This creates a security problem that software-based verification alone cannot fully address: a genuine device may still have been physically altered after manufacturing.
The findings highlight the importance of maintaining custody and integrity throughout manufacturing, warehousing, distribution and retail delivery.
CryptoBilis sales suspended during investigation
Ledger began publicly addressing the incident on October 9, 2026, after receiving reports of unexpected cryptocurrency losses involving customers who purchased devices through CryptoBilis.
The company asked the reseller to suspend Ledger device sales and shipments while the investigation continued.
Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis. As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices. We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up if you have not done so yet. If you have set up your Ledger device, consider moving assets to a new Ledger signer (with new seed). We will continue to inform customers of updates as the investigation progresses.
Reach out to Ledger customer support through official channels with any questions: https://t.co/4p918UH8yb
— Ledger Support (@Ledger_Support) October 9, 2026
Ledger’s response subsequently expanded beyond CryptoBilis. According to additional reporting on the supply-chain attack, the company asked other hardware wallet sellers across Asia to temporarily suspend sales and shipments while investigators examined the extent of the compromise.
The broader precautionary measures raise concerns about potentially tampered devices circulating through multiple distribution channels. However, the sales suspensions do not establish that every affected reseller distributed compromised wallets or that additional customers suffered cryptocurrency losses.
On October 10, Ledger confirmed that at least one affected device contained an unauthorized hardware implant.
Subsequent updates connected the confirmed fund-draining cases under investigation to devices sold through CryptoBilis.
Ledger has emphasized that the investigation concerns physical tampering with distributed products rather than a confirmed compromise of its internal systems or the cryptographic protections built into its Secure Element.
The company has not established where in the distribution process the devices were modified or publicly identified the individuals responsible.
Reports have also emerged involving suspicious Ledger devices purchased through other retail channels, including a device discovered in Germany.
On October 13, Ledger acknowledged the European report, and electronics retailer MediaMarkt Saturn suspended Ledger device sales while the matter was examined.
Those developments raise broader questions about distribution security, but they do not establish that all retailers or Ledger product lines are affected.
Researchers estimate losses exceeding $90 million
Independent blockchain investigators have linked substantial cryptocurrency losses to the suspected hardware wallet compromise.
Estimates published during the investigation exceeded $90 million, with some analyses identifying hundreds of potentially affected cryptocurrency wallets.
However, Ledger has not confirmed the total number of victims or the overall financial losses attributable to the implants.
Blockchain transaction analysis can identify suspicious transfers and clusters of related addresses, but it does not necessarily establish the precise intrusion method behind every transaction.
Consequently, the reported loss estimates should not be treated as a confirmed financial impact figure.
The confirmed technical finding is narrower but significant: at least one affected Ledger device contained unauthorized hardware capable of capturing recovery phrases, and Ledger has linked confirmed theft reports in the investigated incident to the CryptoBilis distribution channel.
Hardware wallets face attacks beyond their cryptography
The incident demonstrates how cryptocurrency theft can occur without defeating the cryptographic protections that make hardware wallets valuable.
Hardware wallets are designed to isolate private keys from internet-connected systems, reducing exposure to conventional malware and credential theft.
However, their security also depends on the integrity of the device, the confidentiality of recovery phrases and the software used to manage cryptocurrency assets.
Earlier in 2026, BreachNews reported that a fake Ledger Live application distributed through Apple’s App Store stole approximately $9.5 million from more than 50 victims after users were tricked into entering their recovery phrases.
That attack relied on malicious software impersonating a legitimate wallet application.
The latest incident targets the same critical secret through a different mechanism: a physical implant that captures the recovery phrase while it appears on the hardware wallet itself.
Both attacks illustrate that the recovery phrase remains a central target even when the underlying cryptographic hardware is functioning as intended.
Supply-chain exposure is another recurring concern.
That incident did not compromise Trezor devices or recovery phrases. Instead, it exposed customer information that could potentially support targeted phishing and impersonation.
Although the incidents involved different attack methods and there is no established connection between them, they demonstrate how criminals can exploit weaknesses surrounding cryptocurrency hardware rather than attacking its core cryptographic protections.
What affected Ledger customers should do
Ledger has advised customers who purchased devices through CryptoBilis not to initialize unused wallets while the investigation continues.
Users who already initialized a potentially affected device should treat its recovery phrase as potentially compromised.
The company recommends moving assets to a new, trusted hardware wallet initialized with a newly generated recovery phrase.
Simply resetting a suspicious device or changing its PIN does not secure cryptocurrency associated with an exposed recovery phrase.
Likewise, transferring assets to another wallet restored from the same recovery phrase would not eliminate the risk because an attacker could still recreate that wallet independently.
Users should take the following precautions:
- Verify the seller: Purchase hardware wallets directly from the manufacturer or through verified authorized distribution channels.
- Avoid initializing suspicious devices: Contact official support if a wallet may have been modified or purchased through an affected seller.
- Generate a new recovery phrase: Move assets to a trusted device using entirely new recovery credentials if compromise is suspected.
- Do not rely solely on Genuine Check: Successful cryptographic authentication does not rule out additional physical hardware inside the enclosure.
- Protect recovery phrases: Never enter wallet recovery words into websites, unsolicited applications or support forms.
- Use official support channels: Be cautious of messages claiming to offer emergency wallet verification, recovery assistance or reimbursement.
Ledger also provides official guidance on purchasing and verifying hardware wallets, including the limitations of authenticity checks and the risks associated with third-party marketplaces.
Users should not attempt to dismantle a suspected device unless they have the necessary expertise and understand the risks of damaging the hardware.
The security boundary attackers bypassed
The Ledger implant investigation exposes a fundamental distinction between cryptographic authenticity and physical device integrity.
A Secure Element can successfully prove that it is genuine while unauthorized electronics elsewhere in the same device observe sensitive information.
In this case, attackers reportedly exploited that distinction by targeting recovery phrases at the moment they became visible, then using an independent cellular connection to transmit them.
The result is a supply-chain attack that does not require a firmware vulnerability, a compromised computer or direct extraction of private keys from protected hardware.
As investigators continue tracing the modified devices and their distribution channels, the case illustrates why securing cryptocurrency hardware requires more than strong encryption and authentic components. It also requires confidence that the physical device delivered to the user has not been altered along the way.
