Ledger Finds Hidden Hardware Implant Behind Crypto Wallet Thefts

Highlights:

• Ledger says attackers used a hidden device to steal recovery phrases from wallets sold through CryptoBilis.
• Bitquery traced an estimated $102 million in stolen crypto across 324 wallets, but Ledger hasn’t verified losses.
• Ledger told CryptoBilis customers to avoid setting up unused devices or move their funds to new wallets.

Ledger has revealed how attackers used a hidden hardware implant to steal recovery phrases from its crypto wallets. The discovery comes as investigators look into cryptocurrency thefts linked to devices sold by CryptoBilis, a reseller in Southeast Asia. Meanwhile, blockchain researchers have raised their estimated losses to $102 million across 324 wallets.

In an official update on October 13, Ledger explained how the implant captured users’ recovery phrases during wallet setup. Its Donjon security team examined an affected device after customers reported missing funds on October 9. The company first confirmed finding an unauthorized component inside one wallet on October 10.

Update from Ledger Donjon on the CryptoBilis investigation 🔽@DonjonLedger is investigating Ledger signers sold by CryptoBilis, a reseller in Southeast Asia, that contained an unauthorized hardware implant. Ledger confirmed this on October 10th for one affected user's signer.…

— Ledger (@Ledger) October 13, 2026

How Attackers Used a Hidden Implant to Steal Recovery Phrases

Ledger said attackers placed a small electronic component inside the wallet’s casing. The device could read information shown on the screen while the wallet continued to work normally. During setup, a Ledger wallet displays a 24-word recovery phrase. Users need these words to recover their crypto if they lose their device. But if someone else gets the phrase, they can also access the wallet and move the funds.

That is what made the implant dangerous. According to Ledger, a small microcontroller captured the recovery words when they appeared on the screen. It then sent the information to the attackers over an LTE connection using a built-in eSIM. The attackers did not need to change the wallet’s Secure Element, operating system, or transaction signatures. Instead, they targeted the recovery phrase itself, giving them a way to access funds without using the original device.

Ledger also said its internal systems showed no signs of a breach. All confirmed theft cases tied to the October 9 incident involved devices purchased through CryptoBilis.

Bitquery Estimates $102 Million Stolen From 324 Crypto Wallets

The full amount stolen is still unclear. However, blockchain intelligence firm Bitquery reported on October 12 that attackers had taken an estimated $102 million from 324 wallets. Its investigation traced stolen funds across six networks: Bitcoin, Ethereum, TRON, BNB Chain, Polygon, and Solana.

The estimate has increased as researchers have followed more transactions. Early reports put the losses at around $86 million. Bitquery later identified $92.9 million across 311 wallets before finding another group of affected addresses. Still, 324 wallets do not mean 324 people lost money. One person can own several crypto wallets, so the number of affected users may be different.

Ledger has not confirmed the $102 million estimate or the total number of victims. The company said independent researchers produced these figures, and its investigation is ongoing.

Ledger Warns CryptoBilis Customers Not to Use Affected Devices

CryptoBilis has stopped selling Ledger devices while the investigation continues. Ledger has also warned customers who bought a device from the reseller but have not used it yet to leave it unopened and avoid setting it up.

People who have been using this wallet are advised to transfer their cryptocurrencies to a new hardware wallet and create a new recovery phrase for themselves. It is also important that people do not use their previous recovery phrase because there is a chance that their cryptocurrencies will be exposed to danger in that way. According to Ledger, users who suffered losses should get in touch with the company’s support and inform the local police about what happened.