Ledger CryptoBilis Hack Explained: How a Hidden Chip Stole Crypto Wallet Seed Phrases

On October 13, 2026, Ledger confirmed that crypto hardware wallets sold through a Southeast Asian reseller called CryptoBilis contained an unauthorized hardware implant — an extra, hidden chip that read users’ 24-word recovery phrases during setup and transmitted them to attackers over a cellular network. Onchain investigators have tied the resulting thefts to somewhere between roughly $72 million and $102 million in losses, though Ledger hasn’t confirmed a single total figure, and the investigation into how the devices were tampered with is still open.

This wasn’t a software hack, a phishing site, or a bug in Ledger’s firmware. It was a physical supply-chain attack: someone intercepted real Ledger devices before they reached customers and built a tiny radio transmitter into them. Here’s what’s actually been confirmed, how the attack worked, and — more usefully — what it means for how anyone should buy a hardware wallet going forward.

What Happened, and When

The first public signs came on October 9, 2026, when onchain researchers started flagging unusual outflows from wallets linked to buyers of a reseller called CryptoBilis. Pseudonymous investigator “tanuki42” put early losses above $72 million moving to suspected theft addresses, a figure reported by The Block; another researcher using the handle Specter estimated losses above $86 million. Ledger asked CryptoBilis to pause all hardware wallet sales and shipments while it investigated, a move confirmed by The Defiant.

On October 12-13, Ledger went further: it confirmed that at least one affected device physically contained an unauthorized hardware implant, reported by CoinDesk and The Hacker News. Around the same time, blockchain analytics firm Bitquery pushed the loss estimate higher still, to roughly $102 million across 324 wallets and six networks, while other outlets converged on figures closer to $90-93 million. Separately, reports emerged — unverified by Ledger — of buyers in Europe, including purchases from electronics retailer MediaMarkt, describing similar suspicious hardware, which The Block reported led MediaMarkt to pause Ledger sales in some stores as a precaution, even without a confirmed link to CryptoBilis.

All of the figures above are estimates from independent onchain research, not an official Ledger tally — and outlets reported different numbers at different points in a fast-moving week, which is exactly why the range is so wide. Treat any single dollar figure you see attached to this story as a snapshot, not a final count.

How the Hardware Implant Actually Worked

According to Ledger’s own account of its investigation, reported by The Defiant and crypto.news, the implant consisted of a small microcontroller wired into the device alongside a provisioned eSIM — a cellular chip that doesn’t need a physical SIM card to connect to a mobile network.

During normal wallet setup, a Ledger device generates a brand-new 24-word recovery phrase and displays it on its own screen, word by word, for the owner to write down. The implant was built to watch for exactly that moment: it monitored what the screen displayed, decoded the recovery phrase as it appeared, and then quietly transmitted the words to the attackers over an LTE cellular connection — all while the device otherwise looked and behaved like a normal, working Ledger wallet.

The critical detail is what the implant didn’t touch: Ledger’s secure element (the certified, tamper-resistant chip that actually stores and protects private keys) and its firmware were left completely genuine and unmodified. The implant was a separate, bolted-on component, not a modification of Ledger’s own security hardware.

Why Ledger’s Own “Genuine Check” Missed It

This is the part that should concern anyone who trusts a software verification step as a complete answer. Ledger wallets include a feature called Genuine Check, which verifies that a device’s secure chip and firmware are authentic Ledger components that haven’t been altered. It’s a real and useful check — but it only inspects the chip and software it’s designed to inspect.

Because the CryptoBilis implant left the secure element and firmware untouched and added an entirely separate piece of hardware elsewhere in the device, Genuine Check had nothing to flag: the component it checks really was genuine. A device can pass every software-level authenticity check and still be physically compromised if something has been added to it rather than altered within it. Ledger has acknowledged this limitation directly in its public statements on the incident.

Who Was Actually Affected

Every confirmed case traces back to CryptoBilis, a hardware wallet reseller that operated as an authorized Ledger retailer in Indonesia, Malaysia, and the Philippines, per Protos and Cointelegraph. Ledger said it had no indication that its own systems, direct sales channel, or official reseller infrastructure more broadly had been compromised — the tampering appears to have happened somewhere in CryptoBilis’s specific supply chain, though Ledger has said the investigation into exactly where and by whom is still ongoing.

The unverified European reports (including the MediaMarkt-purchased devices) sit in a different category: suspicious, but not confirmed by Ledger to be connected to the CryptoBilis implant or to each other. If you bought a Ledger device somewhere other than CryptoBilis, there is currently no confirmed evidence your device was affected by this specific incident — but the retailer-level caution from MediaMarkt is a reminder that “unofficial reseller” risk isn’t unique to one company or one region.

Ledger Device Purchase: Official Channels vs. Unverified Resellers

	Buying direct or from Ledger’s official reseller list	Buying from an unverified / unofficial reseller
Who controls the supply chain before it reaches you	Ledger or a vetted, listed partner	Unknown — any point between factory and reseller is a risk window
Does Genuine Check fully protect you?	Yes, for the checks it covers; still worth running	No better than official channels — it can’t detect physically added hardware either
Risk if device arrives with a PIN or seed already set	Should never happen; red flag immediately	Reported in multiple CryptoBilis-linked cases
What happened in this incident	Not implicated in any confirmed case	Every confirmed case traces here
Recommended action if you bought from here	Normal setup is fine; still inspect packaging	Don’t set up the device; contact the manufacturer first

What Ledger Told Affected Buyers to Do

Ledger’s guidance, relayed across multiple outlets covering the incident, was straightforward and splits into two cases:

• If you bought from CryptoBilis and haven’t set up the device yet: don’t. Contact Ledger Support before doing anything else.
• If you bought from CryptoBilis and already completed setup: assume the recovery phrase is compromised. Move your assets to a different device with a freshly generated recovery phrase, rather than continuing to use the existing wallet.

Ledger also reiterated a standing rule that applies far beyond this incident: the company will never ask anyone for their 24-word recovery phrase, by support chat, email, or otherwise. Any message claiming to be Ledger support that asks for your seed phrase is a scam, incident or no incident.

How to Buy Any Hardware Wallet Without This Risk

The CryptoBilis incident is a supply-chain attack, and the defense against supply-chain attacks is mostly about where and how you buy, not which brand you choose:

• Buy directly from the manufacturer’s own site, or from its official, published reseller list. Ledger maintains one at ledger.com/en/reseller. A listing on a general marketplace isn’t automatically safe — on Amazon, for example, Ledger has noted that the “Sold by” field should match an entity on its official list, not just display a generic storefront name.
• Treat a pre-set PIN or a visible recovery phrase as an immediate dealbreaker. A genuine new device generates its recovery phrase itself, on its own screen, during your setup — it should never arrive with one already chosen, written down, or printed for you.
• Inspect packaging before opening it. Tamper-evident seals that look broken, re-glued, or inconsistent with official packaging photos are a reason to stop and contact support rather than proceed.
• Run the manufacturer’s authenticity check, but know its limits. It’s a real layer of protection, not a complete guarantee — as this incident showed, it checks the chip and firmware it’s designed to check, not every physical component that could theoretically be added to a device.
• When in doubt, start over with a new device and a new phrase. If a device’s origin is at all uncertain — a gift, a secondhand purchase, an unfamiliar seller — the safest move is generating a brand-new recovery phrase on a device you’re confident is clean, rather than trusting one you can’t fully verify.

None of this is specific to Ledger. Any hardware wallet brand’s supply chain can theoretically be targeted the same way between the factory and an unofficial reseller’s shelf; the mitigation is the same regardless of brand.

The Bigger Pattern

This incident adds a new category to a crypto security landscape that’s had a rough stretch — supply-chain tampering of the exact devices people buy specifically to be more secure than a software wallet. It’s a useful contrast to the MetaMask staking incident from late September, which was a software infrastructure problem the non-custodial key design contained, and to exchange hacks like Bitget’s $387.5 million breach, where attackers compromised a custodian’s internal systems directly. CryptoBilis is neither: it’s what happens when the hardware meant to protect you is altered before you ever touch it.

The practical lesson holds regardless of which of those categories a future incident falls into: where you buy a device that will hold your private keys matters as much as which device you buy, and no single check — software or otherwise — replaces buying from a source you can actually verify. This isn’t financial advice; if you believe a device you own may be affected, Ledger’s own support channels (not a link from an unsolicited message) are the right place to confirm it.