TL;DR
Ledger discovered a hidden spy chip in devices sold by CryptoBilis that captured users’ recovery phrases.
The company confirmed that the attack targeted its distribution chain and did not compromise its internal systems or the wallets’ security chips.
On-chain investigators estimate losses of up to $93.2 million across more than 300 wallets. Ledger has not yet confirmed the number of victims or the total amount stolen.
Ledger confirmed that some devices sold by reseller CryptoBilis contained a spy chip capable of stealing users’ 24-word recovery phrases and transmitting them to attackers over an LTE mobile network.
The company explained that the component had been secretly installed inside the hardware wallets. When a user set up the device and the recovery phrase appeared on its screen, a microcontroller identified and decoded the words before transmitting them through an integrated eSIM .
Update from Ledger Donjon on the CryptoBilis investigation @DonjonLedger is investigating Ledger signers sold by CryptoBilis, a reseller in Southeast Asia, that contained an unauthorized hardware implant. Ledger confirmed this on October 10th for one affected user’s signer.…
— Ledger (@Ledger) October 13, 2026
With this information, attackers could recreate the wallets on other devices and withdraw the funds without needing physical access to the original hardware.
Ledger Identifies a Supply Chain Attack
The investigation found that the spy component did not modify the Secure Element chip , which protects private keys, or Ledger’s operating system. It also did not alter transactions or digital signatures.
According to the company, this was a physical supply chain attack , not a breach of its software or internal infrastructure .
Ledger confirmed that at least one device contained an unauthorized component and that all verified losses from the October 9 incident were linked to products sold by CryptoBilis.
Chief Technology Officer Charles Guillemet announced a review of reseller controls and measures designed to detect physical tampering.
Meanwhile, CEO Pascal Gauthier said the investigation is ongoing to determine who tampered with the devices and at what point in the distribution chain it occurred.
Estimated Losses Reach $93.2 Million
On-chain investigators estimated that the thefts could total $93.2 million across more than 300 wallets . In addition, Tether froze $10 million in USDT linked to the stolen funds.
Ledger clarified that it has not yet confirmed the total value of the losses or the number of affected users . It has also not verified any thefts involving devices purchased outside CryptoBilis, although it is investigating reports of possible spy components in other devices and locations.
Former Mt. Gox CEO Mark Karpelès claimed to have found a spy device inside a Ledger Flex wallet purchased at Singapore Airport. The company continues to investigate these reports.
CryptoBilis has already stopped selling Ledger products. The company advised customers who purchased devices from the reseller not to set them up if they have not yet used them . Those who have already initialized their devices should transfer their cryptocurrencies to a new wallet with a different recovery phrase .
