Ledger has disclosed how a physical supply-chain attack involving hardware wallets sold by Southeast Asian reseller CryptoBilis may have enabled attackers to steal users’ crypto funds. The French wallet maker said an unauthorized component inside at least one device read recovery phrases displayed during setup and transmitted them over an LTE mobile network.
According to CoinDesk, Ledger’s first public explanation of the incident says the component operated without changing the company’s software, internal systems or transaction-signing process. Onchain researchers have estimated that more than 300 wallets lost as much as $93.2 million, while Tether froze $10 million in USDT linked to the thefts.
How the implanted component worked
Ledger said the covert hardware was installed inside the enclosure of some devices sold through CryptoBilis. The component included a microcontroller capable of recognizing and decoding the 24 words shown on the device screen when a customer set up a wallet.
After capturing the words, the implant transmitted them to attackers through LTE, the mobile-data technology used by cellular networks. Ledger said the component used an eSIM to connect to the network, meaning the information could be sent without relying on the customer’s internet connection or the wallet maker’s software.
A recovery phrase is the master credential for a crypto wallet. It can be used to restore access to the wallet on another compatible device or service. Someone who obtains the phrase can therefore move the assets without possessing the original hardware wallet.
The disclosure is significant because the attack targeted the physical device before or during its use, rather than Ledger’s online infrastructure. Ledger said the implant did not alter the secure element, a chip intended to protect private keys, and did not modify the operating system. It also said the component did not interfere with transactions or the signatures used to authorize them.
What Ledger has confirmed
Ledger said it had confirmed one affected signer containing an unauthorized implant. It also said every confirmed loss in the Oct. 9 incident involved a device sold by CryptoBilis. The company has not verified a theft involving a signer bought from another seller, although it is investigating reports of implants in other devices and locations.
The company has not released a confirmed total for the number of victims or the amount stolen. The higher figures come from onchain researchers, who estimated losses of up to $93.2 million across more than 300 wallets. Tether, the issuer of the dollar-pegged stablecoin USDT, froze $10 million connected to the thefts.
The incident illustrates the difference between software security and supply-chain security. A hardware wallet is designed to keep sensitive signing operations isolated from other systems, but a malicious component added before a device reaches its customer can create a separate risk. In this case, Ledger’s account indicates that the attackers focused on the recovery phrase displayed during initialization rather than breaking into the wallet’s secure element.
Guidance for CryptoBilis customers
Ledger said CryptoBilis had stopped selling Ledger signers. Customers who purchased a device from that reseller and have not yet initialized it were told not to do so.
Customers who already used one of the devices were advised by Ledger to transfer their assets to a new device and generate a new recovery phrase. Creating a new phrase is important because moving funds while continuing to rely on a potentially exposed phrase would not remove the underlying access risk described by the company.
Ledger’s warning is specific to devices linked to the reseller and the investigation remains ongoing. The company said it was examining reports of implants in other devices and locations, so its current account does not establish that every Ledger wallet, or every device sold elsewhere, was affected.
Current crypto market picture
Moneyiar market data at 09:29 on Oct. 13, 2026, showed declines across the four tracked assets:
- Solana (SOL): $107.164412173, down 3.95% over 24 hours and 10.16% over seven days.
- Aster (ASTER): $0.6927437008, down 2.25% over 24 hours and 6.39% over seven days.
- Compound (COMP): $23.5096853254, down 6.56% over 24 hours and 3.54% over seven days.
- edgeX (EDGE): $0.3386473165, down 6.2% over 24 hours and 25.16% over seven days.
These market movements are separate from Ledger’s investigation, but they provide the price backdrop for a crypto sector dealing with both market volatility and concerns about the security of physical wallet supply chains.
