Why this matters: a wallet bought to keep crypto offline was quietly sending its master key out over a mobile network — and a normal authenticity check could not see it.
October 19, 2026 — Ledger hardware wallets sold through Southeast Asian reseller CryptoBilis contained a hidden spy implant that read owners' 24-word recovery phrases from the screen and sent them out over a cellular connection, according to Ledger and Bloomberg reporting on October 19. Researcher Mark Karpelès of Tibane Labs, the former head of Mt. Gox, examined a flagged device and found a custom connector tapping the display, plus a cellular chip and SIM card.
Image: A hardware wallet opened to reveal a tiny hidden circuit board with a cellular chip and antenna tucked behind its screen, sending out red signals. Credit: AI-generated illustration / Red Eye Eagle News, original illustration.
Editor's Highlight: The attack did not break Ledger's security chip. It went around it — watching the screen instead — which is why implanted devices could still pass Ledger's Genuine Check.
Table of Contents
- How the Implant Steals the Recovery Phrase
- The Device Ben Yorke Sent for Testing
- A Scale Built for Mass Production, Researchers Say
- What Ledger Has Confirmed — and What It Has Not
- Sales Halts Spread Beyond One Reseller
- What Owners Should Do Now
- Bottom Line
- FAQ
- Sources
Key Facts
| Detail | Information |
|---|---|
| Maker | Ledger SAS, Paris-based hardware wallet maker |
| Reseller in confirmed cases | CryptoBilis, Southeast Asia |
| First loss reports | October 9, 2026 |
| Ledger confirmation | October 10: one device had an unauthorized implant |
| How it steals | Reads recovery phrase from screen, sends it via LTE and eSIM |
| Researcher estimate | Up to $93.2 million, 300+ wallets — not confirmed by Ledger |
| Key researcher | Mark Karpelès, Tibane Labs |
| Ledger advice | Do not set up unused CryptoBilis devices; move funds if you did |
How the Implant Steals the Recovery Phrase
A hardware wallet keeps private keys offline. During setup, it displays a 24-word recovery phrase — the master key that can recreate the wallet anywhere.
According to Ledger's October 13 update, reported by CoinDesk, the implant sat inside the case. When the screen showed the phrase, its microcontroller decoded it and sent it over LTE via an eSIM.
Tech Analysis: Ledger said the implant did not modify the Secure Element or the operating system, and did not alter transactions. The wallet worked normally while a second, hidden system watched it.
The Device Ben Yorke Sent for Testing
Ben Yorke bought a Ledger Flex at a Metapod shop at Singapore's Changi Airport, Bloomberg reported. Before setup, he noticed something wrong.
"I noticed the subtle but suspicious markings on the side, indicating someone may have tried to pry open the back of the device," Yorke said.
He sent it to Karpelès, who found a custom connector tapping the display, plus a cellular chip and SIM card, Bloomberg reported.
"This is not your guy in a garage putting implants on a Ledger," Karpelès told Bloomberg. "This is the kind of scale you see in spy movies."
A Scale Built for Mass Production, Researchers Say
Tibane Labs found two implant versions in Nano X devices, BleepingComputer reported. In one, a smaller battery made room for the added circuitry.
Under the battery sat an ST STM32G431KBU6 microcontroller, a tiny eSIM just 2 by 2 millimetres, and a shielded LTE module.
| Part | Role, researchers say |
|---|---|
| Microcontroller | Reads screen output and button presses |
| LTE module + antenna | Sends the stolen phrase over a mobile network |
| eSIM / SIM | Gives the implant its own cellular identity |
Newsroom Focus: Karpelès told Unchained October 15 the newest version clips in and is built for mass production, and said he also found it in devices from Metapod and MediaMarkt in Germany — claims Ledger has not confirmed outside CryptoBilis.
What Ledger Has Confirmed — and What It Has Not
Ledger began investigating October 9, asked CryptoBilis to halt sales, and on October 10 confirmed an implant in one user's device.
Ledger has said every confirmed loss involved a device sold by CryptoBilis, and it had not verified a theft from a signer bought elsewhere. It called this a physical supply-chain attack, not a breach of its software or systems.
Bloomberg reported October 19 that Ledger blamed a "highly organized criminal group" and was reviewing reports from elsewhere, with law enforcement involved. CryptoBilis did not respond to Bloomberg.
Ledger has not confirmed a total. Onchain researchers estimated up to $93.2 million across 300+ wallets, CoinDesk reported, with Tether freezing $10 million in USDT.
Tech Analysis: On the German report, Ledger said inspected stock showed no tampering, but it had not yet examined the devices shown online, Unchained reported.
Sales Halts Spread Beyond One Reseller
CryptoBilis has stopped selling Ledger signers, Ledger said. Bloomberg photographed an October 10 notice closing its physical stores temporarily.
MediaMarkt Saturn stopped selling Ledger devices after a customer report in Germany, Ledger said October 13. No funds were reported lost in that case, CoinDesk reported.
CTO Charles Guillemet said Ledger is reviewing reseller controls and anti-tamper protections, CoinDesk reported.
What Owners Should Do Now
- Bought from CryptoBilis and not yet set up? Do not initialise it. Contact Ledger.
- Already set one up? Move assets to a new device with a new recovery phrase.
- Never share your recovery phrase — Ledger will not ask for it.
- Buy future devices only directly or through a verified authorised channel.
Do not rely only on Genuine Check. Ledger warns it cannot detect added implants if the Secure Element stays intact, BleepingComputer reported.
Practical Takeaway: A sealed box and a passed check are not proof a device is untouched. Its source matters as much as the device.
Bottom Line
A hidden cellular implant turned some Ledger wallets into spies at setup. Ledger confirmed it in CryptoBilis devices and is still investigating how far it spread — watch for its findings on where tampering happened and what checks follow.
FAQ
How did it steal crypto without hacking the security chip?
It watched the screen, decoded the phrase when it appeared, and sent it over LTE, leaving the Secure Element untouched, Ledger said.
Which seller is confirmed?
CryptoBilis. Ledger said every confirmed loss involved that reseller and it has not verified a drain from a device bought elsewhere.
How much was stolen?
Researchers estimated up to $93.2 million across more than 300 wallets, with $10 million frozen by Tether. Ledger has not confirmed that total.
Why did Genuine Check not catch it?
The original security chip was real and unmodified. Ledger warns the check cannot detect extra hardware added alongside it.
I bought elsewhere. What should I do?
No drain outside CryptoBilis is verified. Keep your receipt and never share your phrase.
Sources
- Bloomberg via Insurance Journal — The Crypto Devices Built to Foil Hackers Came With Spies Inside — https://www.insurancejournal.com/news/international/2026/10/19/889497.htm
- BleepingComputer — Ledger confirms spy chip implant behind wallet crypto thefts — https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/
- CoinDesk — Ledger implant stole recovery phrases from screens — https://www.coindesk.com/tech/2026/10/13/ledger-says-spy-chip-inside-cryptobilis-ledger-devices-transmitted-wallet-keys-over-mobile-network
- Unchained — Ledger implant in devices from 2 more resellers — https://unchainedcrypto.com/mark-karpeles-says-ledger-spy-implant-turned-up-in-devices-from-2-more-authorized-resellers/
- Hero image — AI-generated illustration / Red Eye Eagle News, original illustration.
Join the conversation
Comments
Post a Comment