By Daniel Okafor

A covert chip implanted inside Ledger hardware wallets sold by Southeast Asian reseller CryptoBilis captured users' 24-word recovery phrases from the device screen and transmitted them to attackers over an LTE mobile network, Ledger said Tuesday in an investigation update posted on X.

The disclosure is the first public account of the mechanism behind the CryptoBilis-linked thefts. On-chain researchers estimate the losses at up to $93.2 million across more than 300 wallets, though Ledger has not confirmed the total number of victims or the value stolen.

How did the implant work?

The spy chip sat inside the device enclosure, according to Ledger. When a user initialized the wallet and the screen displayed the recovery phrase, the implant's microcontroller recognized and decoded the words, then transmitted them over LTE — the data transmission standard used by cellphones — via an embedded eSIM.

The recovery phrase is the wallet's master key. Anyone holding it can recreate the wallet elsewhere and move the funds without touching the physical Ledger device or altering a single transaction on it.

Crucially, the attack required no software compromise. Ledger said the implant did not modify the device's Secure Element, the chip built to protect private keys, nor its operating system. It did not alter transactions or signatures. The company characterized the incident as a physical supply-chain attack rather than a breach of its software or internal systems.

What has Ledger confirmed?

Ledger said it has confirmed one affected signer contained an unauthorized implant, and that every confirmed loss in the Oct. 9 incident involved a device sold by CryptoBilis. It said it has not verified any theft involving a signer purchased elsewhere, and is examining reports of implants in other devices and locations.

The French wallet maker has not confirmed the total number of victims or the value stolen. On-chain researchers put the losses at up to $93.2 million across more than 300 wallets. Tether has frozen $10 million of its dollar-pegged stablecoin USDT tied to the theft, according to those estimates.

CryptoBilis has stopped selling Ledger signers, Ledger said. The company told customers who bought a device from the reseller not to initialize it. Customers who have already used one should move their assets to a new device with a newly generated recovery phrase.

What does this mean for hardware wallet buyers?

The incident is a blunt reminder that a secure element and audited firmware only protect the device as shipped. Once a reseller can open the enclosure and insert hardware, the trust model breaks at the point of sale, not in the code.

For Ledger, the operational fallout centers on channel control: the company must now verify reports of implants beyond the single confirmed device and geography, and reassure a customer base that bought through third parties across Southeast Asia. The confirmed device count stands at one, but the loss estimates span 300-plus wallets.

Customers holding devices sourced from CryptoBilis face a hard deadline of their own making — every hour an old recovery phrase stays active is exposure. Ledger's guidance is to migrate funds to a freshly generated wallet immediately.

The company says its examination of additional implant reports across other devices and locations is ongoing.