# Ledger Finds Hidden Cellular Chip That Sent Recovery Phrases From Reseller-Sold Wallets

Investigators put losses at $86 million to $93 million across more than 300 wallets on Bitcoin, Ethereum and Tron, and the implanted devices reportedly passed Ledger's own authenticity check.

- Published: 2026-10-15T05:43:12.254Z
- Canonical: https://polylog.news/crypto/2026-10-15/ledger-finds-hidden-cellular-chip-that-sent-recovery-phrases
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [Bitcointalk Dev & Technical](https://bitcointalk.org/index.php?topic=5596402.0), [Blockstream Blog](https://blog.blockstream.com/multisig-is-back-in-the-blockstream-app/), [CoinDesk](https://www.coindesk.com/tech/2026/10/13/ledger-says-spy-chip-inside-cryptobilis-ledger-devices-transmitted-wallet-keys-over-mobile-network), [Ledger on X](https://x.com/Ledger/status/2109896739985453358), [BleepingComputer](https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/), [Cybersecurity News](https://cybersecuritynews.com/hardware-implant-in-crypto-wallet/), [Tech Times](https://www.techtimes.com/articles/328907/20261013/ledger-hardware-wallet-supply-chain-attack-genuine-check-passes-implanted-devices.htm)

Ledger's internal security team, Ledger Donjon, is [investigating signers sold by CryptoBilis](https://x.com/Ledger/status/2109896739985453358), a reseller that operates in Indonesia, Malaysia and the Philippines. The company confirmed on October 10 that one affected user's device contained an unauthorized hardware implant. That confirmation came a day after a coordinated draining of wallets. According to [Cybersecurity News](https://cybersecuritynews.com/hardware-implant-in-crypto-wallet/), every confirmed case tied to the October 9 incident involved a device bought through CryptoBilis. Users on the Bitcointalk developer board had [already flagged a possible problem](https://bitcointalk.org/index.php?topic=5596402.0) with Ledger devices from the reseller.

The attack did not break the device's cryptography. According to Ledger's description, reported by [CoinDesk](https://www.coindesk.com/tech/2026/10/13/ledger-says-spy-chip-inside-cryptobilis-ledger-devices-transmitted-wallet-keys-over-mobile-network), the implant sits inside the enclosure and reads what the screen displays. During setup, the device shows the owner a 24-word recovery phrase. The implant's microcontroller detects those screens, decodes the words, and transmits them over a mobile data network using a pre-provisioned embedded SIM card (eSIM). The implant leaves the secure element and the operating system unchanged, and it does not alter transactions or signatures. [Tech Times](https://www.techtimes.com/articles/328907/20261013/ledger-hardware-wallet-supply-chain-attack-genuine-check-passes-implanted-devices.htm) reports that the implanted units passed Ledger's Genuine Check. That check confirms the secure chip is authentic, but it does not detect a separate component hidden inside the case.

Estimated losses range from $86 million to $93 million, taken from more than 300 wallets on the Bitcoin, Ethereum and Tron blockchains, according to [BleepingComputer](https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/) and other trackers. No recovery, freeze or attribution has been announced. Ledger told anyone who bought from the reseller in the past 90 days not to set up the device, and told those who already have to move their funds to a new signer with a new recovery phrase. CryptoBilis has stopped selling all hardware wallets while the investigation continues. Its inventory also includes Trezor, OneKey, Tangem and SafePal devices.

The root cause is a supply-chain compromise inside an authorized retail channel. Ledger's position is that its secure element held, which is accurate and also convenient for the company, since it places the failure with the reseller. Critics can respond that a key a user can read off the screen can also be read by a component nobody checks. Separately, Blockstream this week [restored multisig accounts](https://blog.blockstream.com/multisig-is-back-in-the-blockstream-app/) in its app, offering 2-of-2 and 2-of-3 setups that include a backup key only the user holds. In a multisig wallet, a seed captured from one compromised device cannot move funds on its own.

## What this means

The exposed mechanism is the trust model behind retail self-custody. That model assumes a certified secure element protects the key, but every single-signature device shows the key on screen once during setup, and an implant can read it there. The people losing money are holders who bought through third-party channels, mainly in Southeast Asia. Every vendor that relies on resellers faces the same exposure, because the attack does not depend on Ledger's particular design. There is a precedent: in 2021, after Ledger's 2020 customer-data leak, tampered Ledger devices were mailed to customers. Sales and the brand survived, and buyers shifted toward ordering direct. Many will read this as a Ledger brand problem. The desk thinks the larger change is to retail distribution itself. The likelier outcome within weeks is that vendors cut back authorized-reseller programs and push direct sales and tamper-evident packaging, while larger holders move toward multisig across different vendors and toward custodial or exchange-traded fund products. That outcome depends on Donjon confirming the implant was limited to this one reseller. If implanted units turn up in other sales channels or other brands, the problem becomes systemic and outflows to custodians would accelerate. If the investigation finds the implants were inserted by someone other than the reseller, the response would shift toward policing and logistics rather than distribution policy.

## What to watch

- Ledger Donjon's final report, and whether it finds implants in devices from other brands sold by CryptoBilis or through other channels. Either finding would turn a regional incident into an industry-wide recall problem.
- Whether Tether or Tron-based exchanges freeze any of the stolen funds on Tron. That would show how much of the theft can still be stopped by centralized issuers.
- Police or regulatory action in Malaysia, Indonesia or the Philippines against the reseller or its suppliers. That would show whether the compromise happened before or after the devices reached the shop.