Ledger Implant Exposes Recovery Phrases in Supply-Chain Attack
Ledger has tightened reseller rules after confirming that some genuine hardware wallets sold by Southeast Asian reseller CryptoBilis carried an unauthorized hardware implant. During setup, the implant captured users’ 24-word recovery phrases from the device screen and sent them over a mobile network. It did not compromise Ledger’s Secure Element, operating system or transaction-signing process, so affected devices could still pass authenticity checks.
Ledger says all confirmed losses involve CryptoBilis devices and it has found no evidence of tampering in its direct sales channel. On-chain researchers estimate that more than 300 wallets lost $86 million to $93 million, but Ledger has not verified those figures or confirmed total customer losses. Tether reportedly froze about $10 million in USDT. After a customer reported an implant in Germany, retailer MediaMarkt Saturn temporarily paused Ledger sales; Ledger says inspections of German stock and warehouse samples found no further tampering.
On October 15, 2026, Ledger told authorized retailers to keep new devices off public display, stop reselling returned wallets and suspend sales in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong. CryptoBilis had been ordered to stop sales and shipments on October 9. Buyers who initialized a CryptoBilis device should treat its recovery phrase as compromised and move assets to a new wallet with a fresh phrase. Those who have not initialized one should leave it unused and contact Ledger Support. The Ledger implant highlights hardware-wallet supply-chain risks; using multisig with devices from different manufacturers can reduce single-device exposure, but cannot eliminate security risks.
Neutral
The incident raises concerns about hardware-wallet security and may prompt some traders to move assets, review custody practices or diversify devices. Those reactions could create temporary activity in affected wallets, but the reports do not identify a direct compromise of Bitcoin, USDT or another cryptocurrency’s network, protocol or market operations. The confirmed issue is limited to certain reseller-distributed Ledger devices, and Ledger says its core security systems remain intact. Historically, security incidents can weigh briefly on sentiment toward related products, but without evidence of broader protocol or asset risk, a sustained price effect on the mentioned cryptocurrencies is not established. The expected direct price impact is therefore neutral.