A hidden chip read 24-word recovery phrases directly from the screen of Ledger wallets and transmitted them across cellular networks. On October 13, 2026, Ledger disclosed technical details regarding tampered hardware distributed by CryptoBilis, an official reseller for Southeast Asia covering Indonesia, Malaysia, and the Philippines.
Initial reports arrived on October 9, 2026, after multiple users found their crypto balances had suddenly vanished. A day later, Ledger engineers confirmed the presence of an unauthorized physical implant inside an inspected unit. All verified losses consistently pointed to wallets purchased through CryptoBilis.
What makes this breach particularly dangerous is not an operating system vulnerability, but physical manipulation carried out before the devices reached buyers.
How the Microcontroller Intercepts Data Without Touching the System
The implant placed an additional microcontroller inside the device casing to copy the 24-word recovery phrase as text appeared on the screen during initial setup. An eSIM module then transmitted the data over an LTE network to the attackers. This supply-chain attack occurred purely at the physical layer: the Secure Element, Ledger operating system, transactions, and digital signatures were not modified at all.
Losses from this physical exploit are estimated to top hundreds of millions of dollars. Bitquery estimated around $102 million drained from 324 wallets, Yfarmx recorded $103 million, and Specter calculated more than $86 million. Ledger has yet to confirm the total loss, which had circulated around $94 million. Amid asset tracing, Tether froze $10 million in USDT connected to attacker addresses.
The investigation is now raising questions beyond Southeast Asia. An X user named Johannes claimed to have discovered similar implants in two Ledger units from two MediaMarkt outlets in Europe. Ledger stated it has not confirmed whether the European retail findings are related to the CryptoBilis incident.
Asset Protection Measures and Severed Partnerships
The distributor halted operations immediately. CryptoBilis stopped all sales and shipments of hardware wallets across all brands in Indonesia, Malaysia, and the Philippines, and temporarily closed its physical stores.
Other manufacturers promptly severed ties. Trezor and OneKey revoked CryptoBilis’s status as an authorized reseller. OneKey even opened a free replacement program for customers who purchased units between March 1 and October 12, 2026, with a claim deadline of December 31.
With over 8 million wallets sold worldwide, Ledger released mitigation guidance. Users who purchased units from CryptoBilis and have not yet activated them are advised to keep the devices powered off and contact support.
For owners who have already set up devices from CryptoBilis, the remediation must be definitive: immediately transfer all funds to a new wallet with a fresh recovery phrase generated from scratch. Private keys are no longer secure if the 24 secret words were ever displayed on the compromised device’s screen.
Via Cointelegraph.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
