Ledger requested third-party distributors across seven Asian markets to suspend retail sales of its hardware signers on 13 October 2026, following the discovery of unauthorized hardware implants in units distributed by Southeast Asian reseller CryptoBilis. The physical supply-chain compromise enabled an embedded cellular chip to intercept users’ 24-word recovery phrases during device initialization and broadcast them over mobile networks, resulting in on-chain losses estimated by security researchers between $86 million and $93 million. While the Ledger tampered wallets did not compromise the underlying cryptographic microcontrollers or on-device firmware, the incident highlights supply-chain risks for hardware wallet buyers.
New to hardware wallets? Read our guide to what a hardware wallet is and how it protects your crypto.
Mechanics of the Tampered Hardware
The Ledger CryptoBilis incident unfolded on 9 October 2026 after customers reported unauthorized balance drains from newly activated wallets, prompting Ledger to halt CryptoBilis dispatches before confirming the presence of an unauthorized physical circuit board on 10 October.
The physical implant sat directly beneath the screen assembly, intercepting display signals to record the 24-word recovery phrase as it was generated during setup. Using an integrated eSIM and an LTE-enabled microcontroller, the rogue module decoded the seed words and transmitted them over cellular networks without requiring internet access on the host computer.
Ledger hardware wallet security rests on the secure element, a chip built to keep private keys inside the device. Ledger’s security team says the implant did not modify that chip or the device’s software, and did not change any transactions.
Reseller Sales Suspensions in South Asia
Ledger asked resellers in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales while its security team examines returned devices. Ledger has not said when sales will restart.
Ledger says the number of affected devices is limited and that every confirmed loss involves a CryptoBilis device. It has not confirmed the total stolen, which researchers tracking the funds put at $86 million to $93 million. In Germany, the electronics retailer MediaMarkt Saturn also paused Ledger sales after a customer reported an implant, though Ledger said no funds were lost in that case.
Self-Custody vs Custodial Wallets
A self-custodial hardware wallet gives users sole ownership of their cryptographic keys, protecting funds from exchange insolvency or asset freezes, provided the physical supply chain remains intact. Conversely, regulated custodial platforms like CoinDCX manage private keys internally within enterprise-grade institutional custody architectures, removing physical device tampering risks at the expense of requiring users to trust the exchange’s security framework.
Choosing a wallet for long-term holdings? Compare options in our guide to the best crypto wallets in India.
What Ledger Buyers Should Check
Because software authenticity checks like Genuine Check cannot identify rogue circuit boards attached outside the Secure Element, Ledger recovery phrase safety depends on purchasing practices and setup protocols:
- Buy only from Ledger’s website or a reseller on Ledger’s official list of authorized resellers.
- If you bought from CryptoBilis in the last 90 days, do not set the device up. If you already have, move your funds to a new device with a new recovery phrase.
- Reject any device that arrives with a recovery phrase or PIN already filled in.
- Do not use a device whose box looks opened. An intact seal is not proof of safety either, since Ledger says seals can be copied.
- Run Genuine Check in the official Ledger Wallet app, keeping in mind that it confirms the main chip but cannot detect added hardware.
- Never share your recovery phrase. Ledger will never call you or ask for it.
Disclaimer: Crypto products and NFTs are unregulated and can be highly risky. There may be no regulatory recourse for any loss from such transactions. The information provided here is for general informational purposes only and does not constitute investment advice. Please do your own research before making any investment decisions.
FAQs
Was Ledger hacked?
No system hack occurred on Ledger's core infrastructure, as the company confirmed that its internal databases, factory firmware, operating systems, and certified Secure Element chips were not breached.
