Hardware implants in Ledger wallets sold through reseller linked to crypto thefts

Summary

Ledger confirmed an unauthorized hardware implant in at least one device linked to reports of stolen cryptocurrency from wallets sold through CryptoBilis. Researchers say implants captured screen output and button presses, then sent seed phrases over LTE.

Key points

Ledger linked all reports of unexpected fund drains under investigation to devices sold through CryptoBilis, describing the affected volume as limited.
The company confirmed at least one affected device contained an unauthorized hardware implant; the timing and method of tampering remain unclear.
Researchers found two implant variants in Ledger X devices, reportedly replacing or fitting around components such as the battery and foam padding.
The implants reportedly captured display output and button presses to identify seed phrases, then transmitted them to attackers over LTE using an eSIM.
Ledger asked CryptoBilis to stop selling and shipping its devices and is working with authorities to identify the perpetrator.
Ledger advises buyers from the reseller not to set up unused devices and suggests users who already set them up move assets to a new signer with a new seed.
Ledger warns that its Genuine Check cannot detect added implants if the original Secure Element remains intact; it recommends buying through authorized channels.

Article Details

Victim Organization: Users who purchased Ledger devices through CryptoBilis
Incident Type: Supply-chain attack involving hardware implants in Ledger devices, used to capture seed phrases and steal cryptocurrency
Disclosure Date: 2026-10-10
Data Types Exposed: Seed phrases
Cryptocurrency assets
Affected Records: Not disclosed; Ledger confirmed an implant in at least one device and said all reports of unexpected fund drains were linked to devices sold through CryptoBilis.
Affected Data Size: Not disclosed; Ledger described the affected volume as limited.
Operational Impact: Affected devices captured display output and button presses to identify seed phrases, then transmitted them over an LTE connection. Users reported cryptocurrency funds drained from their wallets.
Ransom Or Extortion: None reported.
Claim Status: confirmed