Ledger blames hidden 'spy chip' in CryptoBilis-sold wallets for recovery-phrase theft

Ledger has given its first public account of how crypto was drained from devices tied to Southeast Asian reseller CryptoBilis: a covert hardware implant that read users' 24-word recovery phrases off the device screen and transmitted them to attackers over a mobile network. The company laid out the mechanism in an investigation update posted to X on Tuesday, as reported by CoinDesk.

According to Ledger, the implant sat inside the device enclosure. When a user set up the signer and the screen displayed the recovery phrase during setup, the implant's microcontroller recognized and decoded the words, then sent them out over LTE using an eSIM. The recovery phrase is the master key to a wallet — anyone holding it can recreate the wallet elsewhere and move funds without the physical device and without altering any transaction on it.

Ledger was emphatic that this was a physical supply-chain attack, not a software breach. The implant, it said, did not modify the device's secure element — the chip meant to protect private keys — its operating system, or its transaction signatures. That framing matters commercially for Ledger, and it comes from an interested party; it has not been independently confirmed.

Ledger said it has confirmed one affected signer containing an unauthorized implant, and that every confirmed loss in the Oct. 9 incident involved a device sold by CryptoBilis. It said it has not verified any theft involving a signer bought elsewhere, but is examining reports of implants in other devices and locations. The company has not confirmed a victim count or total value stolen.

Those figures come instead from onchain researchers, cited by CoinDesk, who estimated losses of up to $93.2 million across more than 300 wallets. Tether has frozen $10 million of USDT tied to the theft.

CryptoBilis has stopped selling Ledger signers, per Ledger. The company told anyone who bought one from the reseller not to initialize it, and advised those who already used one to move assets to a new device with a freshly generated recovery phrase.

Key facts

• Mechanism: covert chip read the recovery phrase off-screen at setup, transmitted it over LTE via eSIM — Ledger, via CoinDesk.
• One signer confirmed to contain an unauthorized implant; all confirmed losses involved CryptoBilis-sold devices — Ledger.
• Estimated losses: up to $93.2M across 300+ wallets — onchain researchers, via CoinDesk. Ledger has not confirmed a total.
• $10M in USDT frozen — Tether, via CoinDesk.
• Incident dated Oct. 9, 2026.

The real-world read

The precise numbers — $93.2M, 300+ wallets — are researcher estimates, not Ledger's confirmed tally, and should be read that way. Ledger's repeated insistence that nothing in its software, secure element or signing was touched is accurate to the attack as described, but it's also the line that protects the product; take it as Ledger's position pending outside verification. The open question Ledger itself flags: whether implants exist beyond CryptoBilis's supply chain. Until that's answered, "limited to one reseller" is a claim, not a conclusion.

Not financial advice.

Sources

• CoinDesk, "Ledger says 'spy' chip inside CryptoBilis Ledger devices transmitted wallet keys over mobile network" (Oct. 13, 2026) — secondary reporting of Ledger's Oct. 13 investigation update on X (primary); also the source for the onchain-researcher loss estimates and the Tether freeze.