Ledger Confirms CryptoBilis Hardware Implant Stole Keys

13th October 2026- Ledger has detailed how a spy chip inside wallets sold by reseller CryptoBilis stole users’ recovery phrases. Its Donjon security team said the implant read the seed straight off the screen. It then sent the words out over a mobile network.

Ledger posted the technical update on October 13. It confirmed one implanted device on October 10. Every confirmed loss from the October 9 incident traces back to CryptoBilis.

The reseller served Indonesia, Malaysia, and the Philippines. It has since stopped selling all hardware wallet stock.

How the CryptoBilis Hardware Implant Works

The attack targets the one moment a seed appears in plain sight. During setup, the Secure Element generates the recovery phrase. The screen then shows all 24 words so the owner can write them down.

According to Ledger, the CryptoBilis hardware implant sits inside the enclosure as a separate component. It watches the data feeding the screen. When it detects the recovery screens, a small microcontroller decodes the words.

Then the implant transmits the phrase over LTE using a provisioned eSIM. In short, the thief never needs the device again. With the seed alone, an attacker can rebuild the wallet elsewhere and drain it.

Ledger quoted its Donjon team directly in the October 13 update. The post stressed one limit. The implant does not modify the Secure Element or the Ledger operating system. It also does not alter transactions or signatures.

Why the Secure Element Stayed Intact

This detail matters because it explains why checks passed. The Secure Element is the tamper-resistant chip that creates and guards private keys. Here, attackers never cracked it.

Instead, the CryptoBilis hardware implant grabbed the phrase at the display stage. That happens well before any key protection applies. So the chip that holds your keys looked perfectly genuine the whole time.

That is also why Ledger’s Genuine Check did not flag these units. The tool cryptographically verifies that the Secure Element is authentic and provisioned by Ledger.

However, Ledger’s own Donjon documentation admits a gap. The check cannot detect unauthorized physical modifications, such as spying implants. That blind spot holds whenever the original Secure Element stays intact. Security researchers have flagged it for years.

What Ledger Has Confirmed, and What It Has Not

Ledger has confirmed exactly one device with an implant, verified on October 10. It describes the volume of impacted devices as limited.

In its 72-hour update on October 11, the company drew a firm line. All confirmed cases from the October 9 drain involve CryptoBilis devices. Its own systems and direct sales channels remain unaffected.

Still, the headline loss figures come from outside Ledger. On-chain investigator Specter estimated more than $86M stolen across Ethereum, Tron, and Bitcoin. Other trackers run higher. YFarmX cited totals near $94M to $103M.

Analytics firm Bitquery later tracked roughly $102M across 324 wallets on six chains. It also reported that Tether froze about $10M in USDT. Ledger has not verified these totals, so treat them as estimates.

Questions Swirl Around CryptoBilis

The reseller carried Ledger’s authorization, which has fueled anger among buyers. Many ask why an approved channel shipped tampered hardware at all.

Ownership is murky. Former co-founder Arravind Prabu said the company changed hands in March 2026. He added that an NDA delayed public disclosure until mid-October.

Corporate records cited in coverage name a shareholder called Jiaming, registered in Heilongjiang, China. That holder took 100% of the company from August 3. Binance founder CZ publicly speculated that hackers simply bought the reseller.

No public evidence proves the new ownership ordered the implants. For now, the exact point of tampering in the supply chain stays unverified.

Rivals Respond as Users Demand Answers

Competitors moved quickly to distance themselves. OneKey terminated CryptoBilis authorization. It also offered free replacements for its own devices bought there between March 1 and October 12.

Trezor also removed CryptoBilis from its reseller list. Neither firm reported user losses linked to the incident.

Meanwhile, independent researcher Mark Karpeles shared a teardown of an implanted Nano X from Malaysia. The unit arrived with intact shrink-wrap. The chip hid in the screen padding area. Tibane Labs says it has logged three implant generations since 2025.

Ledger says it is working with law enforcement and the SEAL 911 security group. It has not announced any reimbursement plan for affected users.

How to Protect Your Own Device

The practical advice is direct. Ledger told buyers from the last 90 days not to set up unused CryptoBilis devices.

If you already configured one, move your assets to a fresh seed on a new device. Then contact support and local law enforcement. Buy only from Ledger.com or verified authorized channels.

Never initialize a wallet that arrives with a pre-printed recovery phrase or any sign of tampering. None of this is financial advice, but these steps cut supply-chain risk.

Ledger says its investigation continues, and it is reviewing other reports. The full picture of the CryptoBilis hardware implant should sharpen in the days ahead. That includes the real device count and the true scale of losses.