01
A hidden chip inside tampered Ledger wallets quietly stole crypto recovery phrases over a cell network.
02
Ledger confirmed the implant on October 13, 2026, after users of a reseller called CryptoBilis reported drained wallets.
03
The implant had its own microcontroller and eSIM, reading recovery phrase screens and texting the words to attackers over LTE.
04
It left the original secure chip and firmware untouched, so Ledger's own Genuine Check could not detect it.
05
Onchain investigators estimated losses between roughly 72 million and 102 million dollars, though Ledger has not confirmed a total.
06
All confirmed cases trace to CryptoBilis, a reseller that operated in Indonesia, Malaysia and the Philippines.
07
Ledger told affected buyers who had not set up their device yet not to, and told those who had to move funds to a brand-new wallet.
08
The fix for anyone buying a hardware wallet: buy only from the maker's own site or its published reseller list, and treat any pre-set PIN or seed phrase as a dealbreaker.