Updated Oct 13, 2026, 12:22 p.m. EDT Published Oct 13, 2026, 5:27 a.m. EDT
3 min read
Summary
- Ledger said an unauthorized implant in some devices sold by Southeast Asian reseller CryptoBilis captured users’ 24-word recovery phrases from the screen and transmitted them over a mobile network.
- The company described the thefts as a physical supply-chain attack, not a breach of its software or internal systems, and said it was investigating where the devices were tampered with.
- Ledger urged CryptoBilis customers not to initialize unused devices and advised those who had used them to transfer their assets to a new device with a newly generated recovery phrase.
Concealed hardware placed inside certain Ledger hardware wallet units distributed by Southeast Asian vendor CryptoBilis captured individuals’ 24-word seed phrases right off the display unit and relayed those details to a malicious actor utilizing a cellular network, Ledger revealed on Tuesday during an investigation progress report posted on X.
Ledger explained that the clandestine spy chip resided directly inside the casing of the hardware. As soon as a user configured the signer and the display revealed the recovery words, the integrated microcontroller recognized and decoded the terms before broadcasting them over LTE—a cellular data standard—via an embedded eSIM.
The recovery phrase functions as the ultimate master key governing a cryptocurrency wallet. Anyone in possession of it can recreate the wallet elsewhere and drain all funds without requiring physical access to the Ledger gadget or altering any on-device transaction logic.
This disclosure marks the initial public technical breakdown clarifying how the CryptoBilis-related thefts were executed. Ledger noted that the hardware modification left the device’s Secure Element—the specialized chip safeguarding private keys—and its operating system completely untouched. Furthermore, it did not tamper with transactions or signatures. This security incident constituted a physical supply chain intrusion rather than any compromise of Ledger’s software architecture or corporate infrastructure.
Ledger also utilized X to state that investigations will persist until they successfully identify the perpetrators responsible for modifying the hardware and establish enhanced reseller policies.
“Ledger is reviewing its reseller controls and anti-tamper protections,” explained CTO Charles Guillemet via X. “We invite researchers and other vendors to collaborate with us concerning tamper-detection methods and chain-of-custody protocols.”
Ledger CEO Pascal Gauthier stated that Ledger is “examining the governance applied to our primary sales channels alongside third-party distributors, and we will disclose information as appropriate.” He additionally mentioned that CryptoBilis has halted distribution of Ledger signing devices and that the “inquiry remains active to pinpoint who modified these signers or exactly where along the supply pipeline the interference took place.”
Mark Karpeles, former chief executive of the defunct bitcoin platform Mt. Gox, asserted that he discovered a clandestine spying module inside a Ledger Flex unit purchased at the Singapore Changi Airport.
Additionally, Ledger published an official statement via X indicating that MediaMarkt Saturn suspended sales of its hardware lines following a consumer complaint regarding a “spy” chip discovered inside a unit located in Germany.
Ledger confirmed that it had verified at least one compromised hardware signer featuring an unauthorized modification and that every validated theft tied to the October 9 incident involved hardware originally retailed by CryptoBilis. The firm indicated it had not authenticated any asset compromise involving signers procured from alternative channels while continuing to review allegations concerning unauthorized hardware additions in alternative products and geographic regions.
The French manufacturer has not yet verified the aggregate victim count or the precise monetary volume stolen. Nevertheless, blockchain investigators calculated total losses reaching up to $93.2 million distributed across upwards of 300 distinct wallets, with Tether freezing $10 million worth of its dollar-pegged USDT digital asset connected to the breach.
CryptoBilis has suspended commercial distribution of Ledger signature units, according to Ledger announcements. The enterprise instructed consumers who acquired hardware from this vendor to avoid initializing the units entirely. Individuals who have already put such units into service must transfer their capital immediately to a brand-new device configured with a newly generated seed phrase, the company advised.
UPDATE (Tuesday, Oct. 13 at 12:35 UTC): Integrating statements from the Ledger CEO and CTO following the fourth paragraph alongside details concerning a potentially compromised Ledger Flex acquired at the Singapore Airport.
UPDATE (Tuesday, Oct. 13 at 13:30 UTC): Integrating Ledger’s disclosure that MediaMarkt Saturn halted distribution of Ledger hardware following the discovery of a spy modification within a German retail unit.
Originally published at https://www.coindesk.com/tech/2026/10/13/ledger-says-spy-chip-inside-cryptobilis-ledger-devices-transmitted-wallet-keys-over-mobile-network.
