Ledger’s Donjon security team has identified an unauthorized hardware implant in at least one Ledger wallet sold by Southeast Asian reseller CryptoBilis. The component was designed to capture a device’s 24-word recovery phrase during setup and send it over a mobile network, raising concerns about a suspected theft of more than $86 million.
Ledger disclosed the discovery on Tuesday after confirming the implant in one affected user’s device on October 10. The company said all confirmed losses connected to the incident so far involve wallets sold through CryptoBilis. It has not verified any drain associated with a Ledger device purchased elsewhere.
The manufacturer has not established how many devices were modified, how many users may have been affected or the total amount lost. According to Decrypt, onchain investigator Specter has traced more than $86 million in suspected thefts across Ethereum, Tron and Bitcoin. Ledger cautioned that figures circulating online were produced by third parties and have not been fully verified by the company.
How the implant captured recovery phrases
Ledger devices, which the company calls signers, display a 24-word recovery phrase when they are first set up. This phrase is the wallet’s central backup credential: someone who obtains it can restore the wallet and control the funds held there. It should therefore never be shared or entered into an untrusted device or website.
Ledger Donjon’s analysis found that the unauthorized component was installed inside the wallet’s enclosure. The implant’s microcontroller monitored the device screen, recognized the screens displaying recovery words and decoded the phrase. It then transmitted the information over LTE through a provisioned eSIM.
Ledger said the implant was a separate component. Its findings so far indicate that the hardware did not modify the wallet’s Secure Element or the Ledger operating system, and did not change transactions or signatures. The suspected attack instead targeted the recovery phrase while it was being shown during the initial setup process.
CryptoBilis has confirmed that it halted sales of Ledger devices while the investigation proceeds. Ledger is examining the affected products and said its Donjon team will provide additional information as it analyzes devices it receives.
Ledger reviews reports from other locations
The company is also investigating reports that tampered signers may exist outside the CryptoBilis supply chain. An X user has claimed to have found two modified Ledger devices purchased from retail stores in Europe, although that claim has not been independently verified.
For CryptoBilis customers who have not yet set up their device, Ledger says not to begin the setup and to contact Ledger Support. Customers who have already used one should move their assets promptly to a new device and create a new recovery phrase. Ledger specifically warned users not to enter or restore any recovery phrase on a device purchased from CryptoBilis.
People who have lost funds or possess a device they believe was tampered with should report the matter to local law enforcement. Ledger said they should not send the device to another person or open it before consulting Ledger Support or the police, since preserving the device may assist the investigation.
Customers who bought Ledger products elsewhere can use a Ledger guide to inspect the inside of their device. However, the company warned that opening a signer can damage it and advised users to back up their recovery phrase before attempting an inspection.
Ledger also repeated that it will never call users, contact them directly or request their recovery phrase. That warning is particularly relevant during an active security investigation, when victims may be targeted by follow-up scams posing as support representatives.
Current market picture
Moneyiar market data at 20:44 on October 13, 2026, showed mixed performance among the listed assets:
- EDGE was priced at $0.3334476927, down 5.29% over 24 hours and 25.46% over seven days.
- RAIN stood at $0.0099812466, down 3.84% in 24 hours and 13.48% over seven days.
- CHIP was priced at $0.0577256746, down 2.58% over 24 hours but up 9.5% over seven days.
- AIN was listed at $0.1025293171, down 31.28% over 24 hours and up 48.1% over seven days; the supplied AIN reading was timestamped September 16, 2026, at 01:39.
These market figures describe prices and percentage changes at the stated times and do not establish a connection between market performance and the Ledger investigation.
