Hardware implants in Ledger devices sold by CryptoBilis

On 9 October 2026 Ledger began investigating fund losses reported by people who had bought devices from CryptoBilis, a Southeast Asian reseller, and asked the reseller to stop selling and shipping them. On 13 October Ledger’s Donjon security team described what it found inside an affected device: a separate circuit hidden in the enclosure that read the recovery phrase off the screen during setup and sent it out over LTE through an eSIM.

According to Ledger, the implant did not modify the Secure Element, the operating system, transactions or signatures, and there is no indication that Ledger’s own systems were compromised. Ledger’s support documentation notes that Genuine Check cannot detect an added component when the original Secure Element is intact. Every confirmed loss involved a device sold by CryptoBilis. MediaMarkt Saturn suspended Ledger sales in Europe after a customer in Germany reported a tampered unit.

In its statement of 15 October Ledger called the incident a localized distribution attack rather than a systemic supply-chain attack, asked its authorized resellers and distributors to suspend sales in Southeast Asia and Hong Kong, and said every device it bought and opened in stores to check, including in Germany, was clean. Ledger has not published how many devices or users were affected.

What Ledger advises:

• Buy from Ledger directly or from a reseller on Ledger’s authorized list.
• Do not set up a device bought from CryptoBilis. If you already did, move your assets to a new device with a newly generated recovery phrase.
• If you lost funds, contact law enforcement before opening the device.