Ledger has confirmed that at least one genuine hardware wallet sold through Southeast Asian reseller CryptoBilis contained an unauthorized hardware implant capable of capturing and transmitting customers’ 24-word recovery phrases. The disclosure has raised questions about the limits of device-authenticity checks and the security of the distribution chain.
According to CryptoSlate, the affected customers discovered in early October that funds had disappeared from wallets that continued to operate normally. The devices had been sold by CryptoBilis, an authorized reseller serving Malaysia, Indonesia and the Philippines. Customers therefore had no obvious reason to suspect that the wallets had been opened and modified before reaching them.
Ledger confirmed the implant on Oct. 10 and explained three days later how it worked. A small controller intercepted the information sent to the wallet’s display during setup, reconstructed the recovery phrase and transmitted it through a mobile connection using LTE and an embedded SIM card. The protected chip, operating system and transaction-signing process were not changed.
The recovery phrase is the critical secret generated when a hardware wallet is initialized. It normally consists of 24 words that can restore the wallet and its private keys if the device is lost. Although cryptocurrency remains recorded on blockchains rather than inside the physical wallet, the private keys authorize transactions. Whoever obtains the recovery phrase can recreate the same accounts on another device, meaning the original wallet’s PIN cannot prevent access.
How the implant bypassed the wallet’s main protection
Hardware wallets are designed to keep private keys isolated from an internet-connected phone or computer. When a user approves a transaction, the wallet signs it internally rather than handing the keys to the connected device. That separation is intended to reduce the risk posed by malware on computers and phones.
The suspected attack took place before the owner made a transaction. During initial setup, the recovery words appeared on the wallet’s screen so the owner could write them down and store them offline. The added electronics monitored that exchange with the display and sent the words to the attackers. An owner could complete setup and continue approving legitimate payments without realizing that another party had obtained an identical route to the funds.
Ledger’s Genuine Check verifies that a device contains an authentic Secure Element, the chip used for sensitive security operations. However, the check does not examine every component inside the casing or establish that nothing was added around the original chip. Because the implant left the protected chip and genuine software intact, the device could pass an authenticity check while still being modified.
Tibane Labs separately examined modified Ledger Nano X devices containing electronics that monitored signals between the secure chip and display. One specimen used a custom board hidden beneath the screen and retained the original battery. Those samples were not established as the same devices or linked to the CryptoBilis investigation, but they demonstrate how physical alterations can remain difficult to spot during routine inspection.
What is known about the losses and supply chain
Blockchain analytics firm Bitquery estimates that attackers stole $102 million from 324 wallets across six networks. Ledger has not confirmed that figure and has not established that every reported loss resulted from an implanted device. Bitquery also identified 25 Tron wallets that approved the same transaction within three seconds, a pattern consistent with one party controlling several accounts. Blockchain records, however, cannot show who opened a package, installed hardware or returned a device to a retailer.
In an Oct. 15 update, Ledger said attackers had purchased genuine devices over several months, opened them, added custom components and returned them to distribution through Southeast Asian resellers. The company described the incident as an attack on the distribution channel. It said samples inspected in warehouses and stores showed no tampering and asked authorized resellers and distributors in Southeast Asia and Hong Kong to suspend sales.
Ledger is also tightening controls around returned products and asking sellers to keep devices off display shelves. Germany’s MediaMarktSaturn suspended Ledger sales after a report of a tampered unit. Trezor, a rival wallet maker, said it found no evidence that its own products had been compromised but moved to reduce its reseller network.
Why a replacement device may not solve the problem
The relevant distinction for owners is between the physical wallet and the recovery phrase. A PIN protects access to the original device, but it does not invalidate a phrase that may already have been copied. Setting up a new wallet with the old 24 words would therefore reproduce the same accounts and the same exposure.
Ledger advised people who bought from CryptoBilis not to initialize unused devices. Those who already initialized them were told to move assets to accounts created with a new recovery phrase on a trusted device. The company also advised affected owners to use official support channels, retain potentially relevant evidence and never disclose recovery words to anyone claiming to help recover funds.
The incident shows that a hardware wallet’s security perimeter extends beyond its secure chip. It includes the display, casing, packaging and the chain of custody before the product reaches its owner. Self-custody removes the need to place keys with an exchange, but it still requires confidence that the hardware generating and displaying those keys has not been altered.
Current market picture
Moneyiar market data at the stated times shows mixed performance among the listed assets:
- EDGE was trading at $0.2936973503, down 3.13% over 24 hours and 18.34% over seven days, as of Oct. 17, 2026, at 21:58 +03:30.
- NEX was priced at $0.0000007051, down 4.07% in 24 hours and 13.47% over seven days, as of 21:59 +03:30 on Oct. 17.
- WAL stood at $0.040359975, down 9.99% over 24 hours but up 11.07% over seven days, as of 21:58 +03:30 on Oct. 17.
- OPEN was at $0.1014754745, down 1.04% over 24 hours and 10.16% over seven days, based on data timestamped Oct. 15, 2026, at 00:24 +03:30.
