Community Trust ScoreVerified
An $86 million theft. Hidden inside the hardware itself. Ledger confirmed on October 10 that devices sold by Southeast Asian reseller CryptoBilis carried an unauthorized physical implant — one sophisticated enough to silently steal recovery phrases and beam them out over a cellular network before most victims even knew their funds were gone.
Why It Matters
This incident underscores the vulnerabilities inherent in hardware wallets, which are often seen as secure options for storing cryptocurrencies. The discovery of a physical implant capable of stealing sensitive information highlights the need for rigorous security protocols in the hardware manufacturing process and may erode consumer trust in hardware wallets, potentially impacting market sentiment around crypto security solutions. Furthermore, it raises concerns about the integrity of supply chains in the crypto space, emphasizing the importance of purchasing devices directly from reputable manufacturers.
The discovery came through Ledger Donjon, the company’s in-house security team. What they found wasn’t malware. It wasn’t a phishing link. It was a physical chip embedded in the device that read the 24-word recovery phrase displayed on screen during the initial setup process, decoded it, and transmitted it via LTE using an embedded eSIM. Critically, the implant didn’t touch the Secure Element or the device’s operating system — which is exactly why it went undetected for so long. It just watched the screen. Quietly. Then it sent the phrase out, and whoever was on the other end had everything they needed to drain the wallet.
CryptoBilis halted all Ledger device sales once the breach was confirmed.
How $86 Million Moved Across Three Chains
The total number of affected users still isn’t clear. Ledger hasn’t put a firm number on it yet. But on-chain investigator Specter traced more than $86 million in stolen assets across Ethereum, Tron, and Bitcoin — which gives you a rough sense of the scale even if the full picture isn’t there yet.
And it probably doesn’t stop with CryptoBilis. Ledger said it’s actively reviewing reports of implants found in devices bought from other sources and in other locations. At least one user on X flagged tampered devices purchased in Europe, and Ledger’s team is looking into those claims. Whether those cases are connected to the same supply chain attack or something separate — unclear yet.
The attack is pretty much a worst-case scenario for the hardware wallet industry. The whole point of a hardware wallet is that the private key never leaves the device. The implant didn’t break that rule technically — it just intercepted the recovery phrase at the moment the user first saw it, before they’d written it down, before the wallet was fully theirs. That’s a brutal window to exploit.
What Affected Users Need to Do Right Now
Ledger’s guidance is direct. If you bought a device through CryptoBilis and haven’t set it up yet — don’t. Contact Ledger Support first. Full stop.
If you’ve already set it up and used it, move your assets immediately. Transfer everything to a new device, generate a fresh recovery phrase during setup, and don’t reuse the old one under any circumstances. The old phrase is compromised. Treat it that way.
Don’t try to open the device yourself. Ledger warned that cracking it open could damage the hardware and potentially destroy evidence. If you suspect tampering, file a report with local law enforcement and reach out to Ledger Support before doing anything else. The company wants to collect the devices for Donjon to analyze — so keeping them intact matters.
For users who bought devices from sources other than CryptoBilis, Ledger does have a guide for inspecting device internals. But the same warning applies: back up your recovery phrase first, and know that opening the signer risks damaging it.
One thing Ledger was blunt about — it will never contact you to ask for your recovery phrase. Not by email, not by chat, not by anything. If someone reaches out claiming to be Ledger and asks for your phrase, that’s a scam. The phrase stays with you, always.
Supply Chain Risk in Crypto Hardware
Hardware wallet supply chains have been a concern in the crypto security community for years. The general worry has always been that a device could be tampered with between manufacturer and buyer — swapped out, modified, or loaded with malicious firmware before it ever reaches the customer’s hands. What the CryptoBilis case shows is that the threat is real, not theoretical, and that the tampering can be sophisticated enough to evade standard checks.
Ledger Donjon’s ongoing analysis will probably tell us more about how the implants were installed and at what point in the chain the devices were compromised. The company said it plans to share findings as they come in. No timeline was given for that.
The scope of the investigation keeps widening. Beyond CryptoBilis customers and the European reports, Ledger said it’s reviewing all incoming reports of suspicious devices globally. It’s not treating this as a single-reseller problem — it’s looking at whether the same technique shows up elsewhere.
Specter’s on-chain trace put the theft at over $86 million across Ethereum, Tron, and Bitcoin.
Hub: Bitcoin price, news, and analysis
Frequently Asked Questions
What exactly did the implant in CryptoBilis Ledger devices do?
The implant read the 24-word recovery phrase shown on screen during device setup, decoded it, and transmitted it over LTE via an embedded eSIM — giving attackers full access to the wallet’s funds without touching the Secure Element or operating system.
How much was stolen in the CryptoBilis Ledger hack?
On-chain investigator Specter traced over $86 million in stolen assets across Ethereum, Tron, and Bitcoin, though the total number of affected users hasn’t been confirmed by Ledger yet.
