About $90 Million Was Drained Through Tampered Ledger Wallets. How to Check If Yours Is Safe
Hidden cellular implants inside counterfeit Ledger wallets have been quietly transmitting recovery phrases to thieves, and the window to protect your funds may be narrower than you think.
This post may contain links from our sponsors and affiliates, and Flywheel Publishing may receive compensation for actions taken through them.
About $90 million has been stolen from individuals who purchased tampered Ledger wallets, according to estimates from crypto analytics firm Santiment. An anonymous blockchain investigator, Specter, reports the losses exceed $86 million across Bitcoin (CRYPTO:BTC), Ethereum (CRYPTO:ETH), and Tron (CRYPTO:TRX).
On October 13, 2026, Ledger’s Donjon security team confirmed that devices sold by CryptoBilis, a Southeast Asia-based reseller, contained hidden LTE implants designed to steal recovery phrases. However, Ledger has not provided an official total for the losses. The company said, “Figures circulating online come from third parties, and Ledger has not fully verified them,” and emphasized that its infrastructure, systems, and services have not been compromised.
A Hidden LTE Implant Steals the Recovery Phrase During Setup
A recovery phrase is a list of 24 words that can restore access to your wallet on any device. If someone gains access to this phrase, they can steal your funds from anywhere. According to Ledger, the implant is a separate component inside the device’s case that reads what appears on the screen during the wallet setup process. Its tiny processor decodes the 24 words as they are displayed.
The implant then transmits the recovery phrase over a standard 4G cellular network using an eSIM, which is a built-in digital SIM card that provides its own connectivity. Ledger asserts that this attack does not affect the Secure Element, the tamper-resistant chip that protects the keys, or alter any transactions.
This design is what makes the theft possible. The attackers don’t need to hack Ledger’s secure hardware; they capture the words the owner is instructed to write down. The thieves can then restore the wallet on their own device and move the funds whenever they wish.
Security firm Tibane Labs has identified three versions of the implant, each progressively more sophisticated. They bought the third version from a popular Japanese online marketplace, and it shipped from Malaysia, suggesting tampered devices could reach buyers through various channels.
Ledger Has Traced Every Confirmed Case to One Reseller
In an update on October 11, Ledger reported that a “limited” number of devices are impacted. Every confirmed case is linked to a device sold through CryptoBilis. In response, CryptoBilis has halted sales of its hardware wallets until the investigation concludes, and Ledger has urged resellers across Southeast Asia and Hong Kong to stop selling as well.
Other claims remain unverified. Former Mt. Gox CEO Mark Karpelès said a Ledger Flex bought at Singapore’s airport may have a spy implant, but Ledger has not linked this case to CryptoBilis. In Germany, MediaMarkt Saturn paused Ledger sales after a customer reported an implant, but the retailer stated that no funds were lost. Ledger’s inspection of European retail stock found no signs of tampering.
Competitors in the wallet market have also reacted swiftly. Trezor stated it found no tampered devices from CryptoBilis but decided to sever ties with the reseller regardless. OneKey has revoked CryptoBilis’ authorization and is replacing any devices purchased through them between March 1 and October 13 at no charge.
Despite these developments, Ledger has left some important questions unanswered, including the total number of affected users, the total losses incurred, and how tampered units entered CryptoBilis’ stock. However, this attack targets one company’s supply chain, rather than the underlying code or networks of Bitcoin or Ethereum, so coins stored elsewhere remain safe. Market reactions have been minimal, with Bitcoin dropping 0.4% and Ethereum declining 1.8% over the week ending October 16.
How to Check If Your Ledger Wallet Is Secure
Ledger provides a built-in feature called Genuine Check in its app to verify a device’s Secure Element authenticity. However, Ledger advises that this test cannot detect physical alterations to the device if the Secure Element is intact. Therefore, a passing result does not guarantee the unit is free of an implant.
Owners should consider where the device came from and how they set it up. Ledger recommends that you only purchase from its official store or authorized resellers. If you bought a device from CryptoBilis in the last 90 days and haven’t set it up yet, wait, as the implant activates only during setup.
If you’ve already set up the device, Ledger suggests moving your assets to a new Ledger device (with a new recovery phrase), which will render the stolen phrase useless.
CryptoBilis warns that a wallet is at risk if its recovery phrase was pre-printed or if someone else has seen it. They advise against any offers for “fund recovery,” which are typically scams. Ledger will never request your recovery phrase or PIN, so keep this information private.
Is Your Ledger Wallet Safe?
If you bought a Ledger from CryptoBilis in the last 90 days, or from any unauthorized seller, moving funds to a new device with a new recovery phrase is the safest step. If you bought from Ledger or an authorized retailer and generated the phrase yourself, the confirmed evidence so far does not point at your wallet.
The risk could widen if Ledger confirms an implant in a device bought from its own website or an authorized European retailer. Ledger’s verified loss total, once published, is the next figure to compare against the third-party estimates, and holders who prefer not to manage a recovery phrase can hold Bitcoin through spot ETFs.
Contact [email protected] for any questions or corrections.
Sam Daodu is a crypto analyst who's spent nearly a decade making blockchain understandable—no easy task when most whitepapers read like fever dreams. He writes for 24/7 Wall St., covering Bitcoin, altcoins, and crypto market analysis for investors. Before crypto, he was a tech writer (back when explaining "the cloud" was peak innovation). Since 2018, he's written for CoinTelegraph, Yahoo Finance, The Block, Cryptonews, Zypto, Rain, and more—basically anywhere people want crypto news without the headache. Sam runs MacLabs Marketing, a content agency for crypto brands tired of sounding like AI wrote their website. He also publishes free crypto education on his site for Web3 enthusiasts who think "gas fees" is a typo. When he's not writing or staring at charts, Sam's either: - Watching anime (currently convinced One Piece has better tokenomics than most altcoins) - At the gym sculpting himself into a Greek god - Listening to the music your mum warned you only bad boys listen to Connect: LinkedIn | Email | MacLabs Marketing
