Ledger said its Donjon security research team has uncovered an unauthorized hardware implant hidden inside hardware wallets sold by CryptoBilis, a reseller operating in Southeast Asia. The covert component reads a device's 24-word recovery phrase from the screen while the wallet is being set up and transmits the words over a cellular connection using a provisioned eSIM.

The Paris-based hardware wallet maker announced the finding in a post on X on Tuesday. Ledger Donjon, the company's in-house security research team, confirmed the implant on Saturday, October 10, in one affected user's device. All confirmed losses from the incident, which Ledger first disclosed on Friday, involve devices sold through CryptoBilis, and the company said it has not verified a drain linked to a device bought anywhere else.

Update from Ledger Donjon on the CryptoBilis investigation 🔽 @DonjonLedger is investigating Ledger signers sold by CryptoBilis, a reseller in Southeast Asia, that contained an unauthorized hardware implant. Ledger confirmed this on October 10th for one affected user's signer.…

— (@Ledger) October 13, 2026

Hardware wallets are a mainstay of self-custody, built to keep a user's private keys offline. A Ledger device, which the company calls a signer, displays its 24-word recovery phrase on the screen during initial setup. Anyone who obtains that phrase can restore the wallet on another device and take full control of its funds. The setup screen is therefore the one point at which the phrase is visible outside the device, which is why an implant that reads the display can defeat a wallet's protections without modifying them.

According to the analysis by Ledger Donjon, the implant sits inside the device's enclosure and reads what is shown on the screen. When it detects the recovery phrase screens, its microcontroller decodes the words and transmits them over LTE using the provisioned eSIM.

Ledger said the implant is a separate component, adding that it does not modify the device's Secure Element or the Ledger operating system, nor does it alter transactions or signatures. CryptoBilis has confirmed it stopped selling Ledger devices while the investigation continues, according to Ledger. The case also puts a spotlight on the third-party reseller layer of the hardware supply chain, where devices pass outside a manufacturer's direct control before reaching buyers.

The company has not confirmed the total number of affected users or the value lost, and said figures circulating online come from third parties it has not fully verified. Onchain investigator Specter traced more than $86 million in suspected thefts across Ethereum, Tron and Bitcoin, as Decrypt reported on Friday.

Ledger reviewing reports beyond CryptoBilis

Ledger said it is also reviewing reports of implants in other signers and locations. An X user has claimed to have found two tampered Ledger devices bought from retail stores in Europe, a claim that has not been independently verified.

The company told buyers of CryptoBilis devices who have not yet set them up not to do so and to contact Ledger Support. Those who have set up their devices should move their assets promptly to a new device with a new recovery phrase, and should not enter or restore any recovery phrase on a device bought from CryptoBilis.

Users who lost funds or hold a tampered device should also file a report with local law enforcement, Ledger said, and should not send the device to anyone, or open it, before speaking to Ledger Support or police.

Buyers who did not purchase from CryptoBilis can inspect the inside of their device using a Ledger guide, though the company warned that opening a signer can damage it and urged users to back up their recovery phrase first.

Ledger reiterated that it will never call users, message them directly or ask for their recovery phrase. The Donjon will analyze the devices it receives and share more as the investigation continues, the company said.