Ledger says a covert cellular implant read recovery phrases off wallet screens and sent them out over LTE

What happened

Ledger has explained, for the first time, how the unauthorized implant found inside some of its hardware wallets actually stole funds. In an investigation update published on Tuesday, the company said the covert component sat inside the device enclosure and watched the device screen. When a buyer set up the wallet and the screen displayed the 24 word recovery phrase, a microcontroller inside the implant recognized and decoded the words. It then transmitted the phrase over an LTE mobile network using an embedded SIM, the same kind of connection a phone uses.

The recovery phrase is the master key to a wallet. Anyone who holds it can recreate the wallet on another device and move the funds, without the original hardware and without changing any transaction the device signed. Ledger stressed what the implant did not do. It did not modify the secure element, the chip designed to protect private keys. It did not alter the operating system, and it did not change transactions or signatures. The company described the episode as a physical supply chain attack, not a breach of its software, its internal systems or its direct sales channels.

The mechanism account follows the sequence this desk has tracked since Friday, October 9, when reports of lost funds from buyers in Southeast Asia first surfaced. The devices involved were sold by CryptoBilis, a reseller that was listed as authorized in Indonesia, Malaysia and the Philippines. Ledger confirmed over the weekend that one affected device contained an unauthorized implant, and its earlier update said confirmed cases appeared limited to that reseller channel. Tuesday's update held that line: the company said every confirmed loss in the October 9 incident involved a device sold by CryptoBilis, and that it had not verified a theft involving a signer bought elsewhere. It also said it is examining reports of implants in other devices and other locations.

The loss figures remain researcher estimates, not company confirmed totals. Onchain researchers cited in the reporting put the losses at up to 93.2 million dollars across more than 300 wallets, and other published estimates have ranged from about 86 million dollars to about 103 million dollars. Ledger has not confirmed a victim count or a total. One concrete recovery figure did appear in the reporting: Tether froze 10 million dollars of its USDT stablecoin tied to the theft.

The responses around the channel widened on Monday and Tuesday. CryptoBilis has stopped selling Ledger signers, suspended sales and shipments of all hardware wallet brands across the three countries, temporarily closed its physical stores, and said it is reviewing its processes with independent specialists. Two rival wallet makers cut ties with the reseller even while reporting no evidence their own devices were affected. Trezor said it had received no reports of tampered devices sold through CryptoBilis and found no indication its products were affected, and still removed the reseller from its authorized network. OneKey reported no related user losses, terminated the reseller authorization, suspended onboarding of new resellers, began reviewing its existing distribution network, and offered free replacements for its devices bought from CryptoBilis between March 1 and October 12, 2026, with applications open through December 31. Ledger, which says it has sold more than 8 million hardware wallets, repeated its guidance: buyers who purchased from CryptoBilis should not initialize unused devices, and anyone who already set one up should move funds to a new device with a newly generated recovery phrase. The company urged anyone who suspects tampering to contact its support team and file a police report, and pointed buyers elsewhere to an inspection guide that warns opening a device can damage it and advises backing up the recovery phrase first. Separately, unverified reports from Europe described implants allegedly found in devices bought from a large electronics retail chain. Ledger has not confirmed whether those reports connect to the CryptoBilis case.

Why it matters

The mechanism matters because it defeats the assumption a hardware wallet is built on. The secure element, the operating system and the signing process all appear to have worked as designed, and none of that helped, because the attack never touched them. It read the secret at the one moment the device is required to show it: setup, when the recovery phrase appears on screen so the owner can write it down. A component that can see the screen and has its own radio does not need to break the cryptography. It only needs to be present for those few seconds, once, and the wallet is compromised for its entire life, silently, with no later transaction able to reveal what happened.

That design also explains the pattern of the thefts. Because the phrase left the device at setup, the attacker could wait and drain funds later, from anywhere, which fits losses that surfaced long after purchase and devices that behaved normally in between. It also explains why the company's guidance insists on a newly generated phrase on a new device rather than simply moving funds: any wallet restored from the exposed phrase is exposed forever, wherever it is restored.

The case has become the clearest documented example of a hardware supply chain attack in consumer crypto. Earlier incidents in this space usually involved fake devices, swapped recovery cards or social engineering. This one, on the company's own account, involved real devices, sold through an authorized channel, carrying an added component with a microcontroller and a cellular radio. The rival makers' response shows how the industry reads that: both cut the reseller loose without any evidence their own products were tampered with, because the trust damage attaches to the channel, not only to the brand found inside one device. When a buyer cannot verify what is inside a sealed enclosure, the authorized list is the security model, and every maker on that list now has to defend it.

The unverified European reports are the loose thread. If implants turn up in devices from mainstream retail channels unconnected to one Southeast Asian reseller, the incident changes scale entirely. If they do not check out, the episode stays a contained, if severe, channel failure. That distinction is worth more than the loss total, which remains an estimate the company has not endorsed.

What to watch

Watch whether the examination of reports beyond CryptoBilis produces a second confirmed device, and where it was bought. One confirmed unit proved tampering happened in one channel. A confirmed unit from an unrelated channel would prove something larger.

Watch for a confirmed victim count and loss total from the company. Until Ledger publishes its own figures, the 86 million to 103 million dollar range in circulation is researcher work of varying method, and the 10 million dollar Tether freeze is the only hard recovery number available.

Watch the replacement and review programs. OneKey's free replacement window runs through December 31, and its review of its whole reseller network, alongside Trezor's removal decision, will show whether the industry tightens how resellers are audited, how returns are handled, and whether returned devices can be restocked.

And watch the inspection question. The practical problem this case leaves behind is that an ordinary buyer has no safe way to check inside a sealed device, and the official guidance itself warns that opening one can damage it. Any verifiable check the makers can offer buyers before setup, one that would actually catch added hardware, would be a real change. Statements alone will not close that gap.