Hidden cellular implant in Ledger wallets: how reseller-sold hardware wallets drained roughly $93 million
Ledger confirmed on 10 October 2026 that tampered hardware wallets sold through the Southeast Asian reseller CryptoBilis contained an unauthorized hardware implant designed to capture users' recovery phrases during device setup. The company disclosed the finding through its support account. The implant was not a firmware flaw or a phishing trick, but additional circuitry added to genuine devices somewhere between the manufacturer and the buyer.
An implant behind the display
According to Ledger's confirmation and a technical analysis published by PhishFort, the implant sat behind the device's display and tapped into the screen's data lines. That positioning allowed it to read everything shown on the screen, including the 24-word recovery phrase generated during initial setup. The compromise therefore did not require an infected computer or a malicious app: the wallet itself recorded the seed words at the moment they were generated. CoinDesk reported on 13 October that Ledger described the component as a spy chip which transmitted the captured wallet keys over a mobile network. An out-of-band channel of that kind does not depend on the victim's computer or internet connection, which made the exfiltration difficult to notice. The physical evidence matches the description: as Help Net Security reported, an implant was found on the back of an already-drained device examined after the fact. None of the published analyses identify who built the implant or exactly where in the distribution chain the devices were modified. What the examinations do show is a modification small enough to escape visual inspection and careful enough not to interfere with the wallet's normal operation. That combination of minimal footprint, full function and covert transmission is what makes hardware implants so difficult to catch after the fact. A genuine-looking wallet, a normal setup flow, and a component behind the display copying the seed phrase as it appeared - that is the shape of this incident.
The scale of the losses
Blockchain analytics firm Bitquery estimated on 11 October that suspected losses reached $93.2 million across 315 wallets on six blockchains, with roughly $70.5 million of that sum on TRON. These figures come from Bitquery's on-chain analysis and remain unconfirmed by Ledger, so they should be read as analyst estimates rather than company-verified totals. Analysts tracked stolen funds moving through Tornado Cash in the days after the thefts surfaced; according to the summary published by Tarnkappe, around $81 million was still traceable on-chain as of 11 October. Two containment efforts followed the outflow: Tether froze approximately $10 million in USDT linked to the theft, and roughly $5.35 million in USDC was identified for freezing. CryptoBilis halts its hardware inventory
CryptoBilis, the reseller through which the tampered devices reached customers in Indonesia, Malaysia and the Philippines, halted sales of its entire hardware-wallet inventory once the issue came to light. Ledger's confirmation tied the tampered devices to stock sold through this reseller. The case shows why the point of sale matters as much as the manufacturer. A genuine device that passes through an unauthorized intermediary can be opened, modified and resealed with hardware that is invisible from the outside, and sealed packaging offers little assurance, since a resealed box is difficult to distinguish from a factory-sealed one. Buyers who purchase through third-party shops, marketplaces or resellers inherit whatever integrity those intermediaries maintain, or fail to maintain. What this means for hardware supply-chain trust
Hardware wallets earn their keep through a simple assumption: the device in your hands does exactly what the firmware says and nothing else. Physical tampering breaks that assumption at a layer no software scan can reach. The implant in this incident did not change how the wallet looked or behaved; users saw a normal screen and a normal setup flow while a component behind the display copied the seed phrase and quietly transmitted it. The practical lessons are unglamorous. Buy hardware wallets directly from the manufacturer or an authorized distributor. Treat any device that arrives pre-configured, with a printed recovery phrase or a pre-set PIN, as compromised and discard it. Initialize the device yourself, generate a fresh recovery phrase, and verify the authenticity of the software you pair with it - the same discipline covered in verifying software downloads properly applies to wallet tooling as much as to anything else fetched over Tor. For anyone who bought a Ledger through CryptoBilis, the working assumption should be that the recovery phrase was captured. Funds should move to a wallet initialized on a verified device, and the old seed treated as burned. That principle holds beyond this incident: a recovery phrase should exist in exactly one place, generated by the owner, never pre-printed and never re-used.
