Ledger Confirms a Hardware Implant That Steals Recovery Phrases
A hidden implant inside a Ledger wallet can read its recovery phrase from the screen and send it to an attacker over a mobile network. The device’s security chip can remain intact while the wallet’s recovery phrase is stolen.
Ledger has now confirmed that attack mechanism in its CryptoBilis investigation. If you bought a Ledger from CryptoBilis, check the action steps below before using it again.
The cover image is an AI-generated reenactment, not a photograph from this investigation.
What Ledger has confirmed
In its 13 October 2026 update, Ledger says it confirmed an unauthorised implant in 1 affected user’s device on 10 October. CryptoBilis, a reseller in Southeast Asia, has stopped selling Ledger devices while the investigation continues.
The implant sits inside the case and reads the data shown on the screen. During setup, the wallet displays its 24-word recovery phrase; the implant’s microcontroller decodes those words and transmits them over LTE using a provisioned eSIM.
Ledger says the added component doesn’t modify the Secure Element or Ledger’s operating system, and doesn’t alter transactions or signatures. Once someone has your recovery phrase, they can restore the wallet elsewhere and move the funds without your device.
All confirmed fund losses described in that update involved devices sold through CryptoBilis. Ledger hasn’t confirmed the total number of affected users or the total value lost, and hasn’t fully verified the figures circulating online.
There’s also a newer update about MediaMarkt Saturn. On 13 October, Ledger said the retailer had paused sales in stores and online following an implant report from 1 customer in Germany, with no fund loss reported in that case.
That German report is still under investigation. It’s a reason to follow the updates beyond Southeast Asia, without treating every report as a confirmed case.
The supply chain is part of your wallet’s security
In my earlier post, I wrote about the gap between a genuine chip and an untampered device. Ledger’s findings now give us a confirmed example of an implant reading recovery words without modifying that chip.
Ledger’s own threat model says Genuine Check can’t detect added spying hardware if the original Secure Element remains intact. A successful check verifies the chip’s authenticity; it doesn’t establish the physical history of everything inside the case.
The lesson applies to how we buy hardware wallets. Someone who can alter a device before it reaches you may be able to steal the secret during the setup process you were told to trust.
This investigation hasn’t established who inserted the implants or where they entered the supply chain. Selling an affected device isn’t evidence that the reseller installed it.
Buying directly from the manufacturer removes a reseller from the chain, but it doesn’t guarantee protection against tampering. And intact packaging isn’t conclusive either: Ledger warns that seals can be copied and packages reopened without visible damage.
Security needs to cover the journey from the factory to your hands. Even the hardware.
If you bought from CryptoBilis
Ledger’s current instructions are more urgent than the early warning:
- If you haven’t set up the device, don’t set it up. Contact Ledger Support.
- If you’ve already set it up, transfer your assets promptly to a new device with a new recovery phrase. Restoring the old phrase onto another device carries the possible exposure with it.
- Don’t enter or restore any recovery phrase on a device bought from CryptoBilis.
- If you lost funds or have a tampered device, contact Ledger Support and report it to local law enforcement. Speak to them before sending the device anywhere; if funds were lost, coordinate with law enforcement before opening it.
If your purchase came from MediaMarkt Saturn or another seller and you have concerns, contact official Ledger Support for guidance. The reported German case doesn’t establish that every device from that retailer is affected.
Never type your recovery phrase into a website, app or form. Ledger says it won’t call you, DM you or ask for those words.
Check your purchase receipt before your next setup.
