Ledger reveals how hidden chips stole wallet recovery keys

Ledger has confirmed that an unauthorized hardware implant found inside a cryptocurrency signer sold by Southeast Asian reseller CryptoBilis can capture users’ 24-word recovery phrases and transmit them through a cellular network.

Ledger disclosed the findings on October 13, following an investigation by its Donjon security team into cryptocurrency losses reported on October 9. The company confirmed the presence of an implant in one affected customer’s device on October 10 and said every fund loss it has verified in the incident involved devices purchased through CryptoBilis. The reseller has suspended Ledger signer sales while investigators examine the affected hardware.

Ledger wallet security investigation reveals hidden spying device

According to the company’s latest findings, the unauthorized component sits inside the wallet’s casing and monitors information displayed on its screen. During the initial setup process, a Ledger signer displays a 24-word recovery phrase that allows users to restore access to their cryptocurrency holdings.

The implant contains a microcontroller that can read the information displayed during setup. When it detects recovery phrase screens, it decodes the words and transmits the information through an LTE connection using a provisioned eSIM. Ledger’s findings indicate that the component operates independently of the signer’s normal security systems.

Update from Ledger Donjon on the CryptoBilis investigation 🔽@DonjonLedger is investigating Ledger signers sold by CryptoBilis, a reseller in Southeast Asia, that contained an unauthorized hardware implant. Ledger confirmed this on October 10th for one affected user's signer.…

— Ledger (@Ledger) October 13, 2026

In its statement, Ledger explained that the device does not modify the Secure Element, the chip responsible for protecting private keys. The implant does not alter the Ledger operating system, cryptocurrency transactions or digital signatures. Its function is to capture sensitive information shown during wallet initialization.

The company said its investigation has not established that the incident affects devices purchased through other distribution channels. “We have not verified a drain linked to a signer bought elsewhere,” Ledger stated. However, its security researchers continue reviewing reports involving hardware modifications in other devices and locations.

The latest technical findings provide additional information about the hidden hardware discovered in CryptoBilis-sold Ledger wallets. Ledger initially confirmed the presence of an unauthorized component on October 10 but had not publicly established its operating method at that stage.

CryptoBilis stops sales as Ledger investigates reported thefts

The investigation began after Ledger received reports of missing cryptocurrency from customers who had purchased devices through CryptoBilis, a hardware wallet reseller serving Southeast Asian markets. On October 9, the manufacturer began examining the complaints and requested that the distributor stop selling and shipping its products.

By October 10, the company’s security team had identified an unauthorized implant inside a device belonging to one affected customer. CryptoBilis subsequently confirmed that it had stopped selling Ledger signers while the investigation continued.

Ledger has not established how the unauthorized components entered the affected devices or identified those responsible for installing them. The company has not announced any arrests, criminal charges or completed enforcement actions connected to the incident.

Meanwhile, blockchain analytics company Bitquery estimated that suspected cryptocurrency thefts connected to the investigation reached approximately $102 million across 324 wallets in its October 12 analysis. The firm traced movements involving Bitcoin, Ethereum and other blockchain networks while examining possible connections between affected addresses.

The figures remain independent estimates. Ledger has not confirmed Bitquery’s loss calculation, the number of affected customers or whether every suspicious transaction identified by researchers resulted from the hardware implant.

In its October 13 statement, the manufacturer said, “We have not confirmed the total number of affected users or the total value lost.” It cautioned that figures circulating online came from third parties and had not been fully verified by its investigators.

Separately, the company said its Donjon team would continue examining devices submitted during the investigation. Researchers are expected to assess the physical modifications and determine whether other affected signers contain similar components.

Ledger urges CryptoBilis customers to move their crypto

Following the findings, Ledger issued security instructions for customers who purchased signers through CryptoBilis. The company advised anyone who had not initialized their device to avoid setting it up and contact Ledger Support before taking further action.

Customers who have already used affected devices were instructed to transfer their cryptocurrency promptly to a new signer initialized with a completely new recovery phrase. Ledger specifically warned users not to import or restore their existing recovery words into another device purchased from CryptoBilis.

The recommendation follows the company’s findings that the implant can capture recovery phrases displayed during setup. A user who transfers an exposed recovery phrase to another hardware wallet would continue using credentials potentially known to an attacker.

For customers who lost funds, Ledger requested reports through its official support channels and advised them to contact local law enforcement. Users holding suspected tampered devices were told not to send their hardware to anyone before consulting Ledger Support or the relevant authorities.

The manufacturer said victims should coordinate with law enforcement before opening their signers, particularly when the device could be needed for an investigation. Opening the hardware without proper handling could affect the condition of physical evidence.

Ledger reiterated that it would never call customers, send unsolicited direct messages or request their recovery phrases. The warning follows separate reports of fake Ledger websites attempting to steal wallet recovery phrases, although no direct connection between those phishing campaigns and the CryptoBilis hardware incident has been established.

For customers who obtained their devices elsewhere, Ledger has made inspection guidance available through its support website. The company warned that opening a signer can damage it and advised users to ensure their recovery phrases are securely backed up before attempting an inspection.

Ledger Donjon continues examining hardware implants

Ledger’s Donjon research team is continuing its technical examination of the modified signers. The company said its investigators would analyze additional devices as they arrive and release further information when new findings have been verified.

The team specializes in hardware and software security research, including physical attacks against cryptocurrency signing devices. Ledger’s research documentation describes work involving circuit analysis, component inspection and testing of security mechanisms used to protect private keys.

The investigation has focused on how the unauthorized component captured information from the device’s display. Ledger’s October 13 findings identify a separate microcontroller and cellular communication system, with no confirmed modification to the Secure Element or signing process.

The company has requested information from researchers and others who may have evidence concerning the modifications. Relevant findings can be submitted to [email protected], while affected customers have been directed to Ledger Support.

Ledger said it would continue reviewing reports involving other signer models and geographic locations. The company has not announced a date for completing the investigation or publishing a final report.