Ledger devices sold by reseller CryptoBilis: LTE implants stole recovery phrases

What happened

• Ledger opened an investigation on 9 Oct 2026, confirmed a hardware implant on 10 Oct, and described it on 13 Oct. All confirmed drains involve devices sold through Southeast Asian reseller CryptoBilis. Losses: more than USD 86M per pseudonymous investigator Specter (other estimates up to about USD 93M). Ledger has not confirmed a total and calls the affected volume “limited”.
• Root cause per Ledger: an implant inside the enclosure reads the screen during setup, decodes the 24-word recovery phrase and sends it over LTE using a provisioned eSIM. It does not modify the Secure Element or Ledger OS, so Ledger’s Genuine Check cannot detect it. Researchers (Tibane Labs, Mark Karpeles) documented several variants, including units bought on Amazon Japan and Yahoo Auctions Japan.
• Attribution: none. Ledger says it is still investigating who tampered with the devices and where.
• Response: CryptoBilis paused sales. Ledger asked resellers in seven Asian markets to pull stock. MediaMarkt Saturn paused Ledger sales after one German report; Ledger says European inspections found no tampering. Users told not to set up CryptoBilis devices and to move funds to a new device with a new phrase.

Sources

• https://bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts
• https://therecord.media/ledger-cryptocurrency-wallet-implant-theft
• https://thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html
• https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/
• https://www.bleepingcomputer.com/news/security/trezor-warns-of-suspected-crypto-theft-implant-in-hardware-wallet/

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.