Ledger wallet implant: tampered devices sent users' seed phrases over LTE
Ledger confirmed in October 2026 that some of its hardware wallets sold through the Southeast Asian reseller CryptoBilis had a hidden implant that read the 24-word recovery phrase off the screen and sent it to an attacker over a mobile network. CoinDesk reported on 13 October that on-chain researchers put the losses at up to $93.2 million across more than 300 wallets, and that Tether froze $10 million of USDT tied to the theft. Ledger has not confirmed a total. Trezor says none of its devices were compromised, and has cut its reseller network anyway.
How the implant took the seed phrase
Ledger's Donjon security lab said the implant's microcontroller detects and decodes the 24-word phrase shown during setup or restore, then transmits it over LTE using a provisioned eSIM. The part was separate from the device. It did not touch the secure element or the operating system, and it did not alter transactions or signatures, so the device's own integrity checks could not see it. The phrase is the master key. Whoever has it can rebuild the wallet on another device and move the funds without the original hardware.
Ledger's account of the attack, in its post of 15 October, is that a criminal group bought genuine devices over many months, fitted the components, and put the devices back into distribution through resellers in Southeast Asia. Ledger says there was no flaw in its chip, operating system or servers, and calls it an attack on the distribution channel after the devices left its control. That is the company's own description, and it has not named the group.
What Ledger and Trezor have said
Ledger opened its investigation on 9 October, asked CryptoBilis to stop selling, and on 12 October confirmed an unauthorized implant in at least one affected device. It said every confirmed loss from the 9 October incident involved a device sold by CryptoBilis, and that it had not verified a theft involving a device bought elsewhere. Researchers have reported tampered devices from other sellers, and Ledger says it is examining them. Its own spot-buys from German stores and its warehouse samples were clean, and it has told authorized resellers in Southeast Asia and Hong Kong to suspend sales.
Ledger's advice to CryptoBilis buyers: do not set up an unused device, and if you already have, move your assets to a new device with a newly generated recovery phrase. Trezor said it found no evidence that its devices were compromised, and it is ending its authorization of the affected resellers on 1 January 2027. Trezor removed CryptoBilis from its list on 12 October as a precaution.
What this changes for a buyer
The case is a seller problem and not a firmware bug. A genuine device that was opened and refitted before it reached the buyer passes every on-device check, so where it was bought is the only protection a buyer controls. The wallets page covers how cold storage works and where to buy it. The usual warning sign was price: researchers said the tampered devices sold for nearly half the original price. A seed phrase on a device from any other seller is the one to replace. The crypto privacy page has the wider picture of what a seed phrase protects and what exposes it.