Keycard Shell vs Ledger Flex

On 9 October 2026 Ledger began investigating fund losses reported by people who had bought devices from CryptoBilis, a Southeast Asian reseller, and asked the reseller to stop selling and shipping them. On 13 October Ledger’s Donjon security team described what it found inside an affected device: a separate circuit hidden in the enclosure that read the recovery phrase off the screen during setup and sent it out over LTE through an eSIM.

According to Ledger, the implant did not modify the Secure Element, the operating system, transactions or signatures, and there is no indication that Ledger’s own systems were compromised. Ledger’s support documentation notes that Genuine Check cannot detect an added component when the original Secure Element is intact. Every confirmed loss involved a device sold by CryptoBilis; Ledger said it was still examining reports of implants in devices bought elsewhere. MediaMarkt Saturn suspended Ledger sales in Europe after a customer in Germany reported a tampered unit. On-chain researchers estimated losses above $86 million; Ledger has not verified that figure.

If you are buying or already own a Ledger device:

• Buy from Ledger directly or from a reseller on Ledger’s authorized list.
• Do not set up a device bought from CryptoBilis. If you already did, Ledger advises moving your assets to a new device with a newly generated recovery phrase.
• If you lost funds, Ledger asks you to contact law enforcement before opening the device.

The incident concerns how devices reached buyers, not the device design, so it does not change our ratings. We will update this notice as Ledger publishes its findings.