Last updated: October 13, 2026
The quick answer
Ledger has confirmed that some of its hardware wallets sold through CryptoBilis, a Southeast Asian reseller, carried a hidden hardware implant that sent recovery phrases out over a cellular connection, and researchers link the scheme to tens of millions of dollars in stolen crypto. If you bought a Ledger from that reseller, do not set it up, and if you already did, move your funds to a new wallet with a brand-new recovery phrase; buyers elsewhere should check where their device came from, since Europe’s MediaMarktSaturn has also pulled Ledger products while tampering claims are investigated.
What happened
On October 9, Ledger said it was investigating reports of crypto disappearing from wallets bought through CryptoBilis, a large hardware wallet retailer based in Malaysia, and asked the reseller to stop selling and shipping Ledger devices. CryptoBilis went further and paused sales of all the hardware wallets it carries while the investigation runs.
A day later, Ledger confirmed that at least one affected customer’s device contained an unauthorized hardware implant. Security researchers who opened suspect units, including former Mt. Gox CEO Mark Karpelès and the team at Tibane Labs, describe a small added board that watches what appears on the screen and which buttons are pressed during setup, captures the recovery phrase, and sends it out through a built-in eSIM. On October 13, Ledger said the implants transmitted recovery phrases over cellular networks and that it is now looking into reports beyond CryptoBilis.
Ledger has not confirmed how much was stolen. On-chain researchers have published estimates ranging from more than $72 million to over $90 million moved out of victims’ wallets, but those figures have not been independently verified and may overlap.
The story widened to Europe on October 13. A buyer said he found similar extra cables and cellular modules inside two Ledger devices bought at different MediaMarkt stores. Ledger has not confirmed tampering on those units, but MediaMarktSaturn told Cointelegraph it has removed all Ledger products from its stores and online platforms and is in contact with the manufacturer.
What it means for you
A hardware wallet’s whole job is to keep your recovery phrase offline. An implant that copies the phrase during setup defeats that protection completely: whoever receives the phrase can rebuild your wallet anywhere and empty it, no matter how carefully you store the paper backup afterward.
Two details matter most. First, according to researchers, Ledger’s built-in Genuine Check cannot spot an added implant as long as the device’s original secure chip is untouched, so a passing check is not proof your unit is clean. Second, restoring your existing recovery phrase onto a new device does not help, because the phrase itself may already be in the attackers’ hands.
What to do now
- Find out where your device came from. Check your order confirmation or receipt. Note the seller, the marketplace and the date. Ledger asked anyone who bought from CryptoBilis in the past 90 days to take action.
- Bought from CryptoBilis and not set up yet? Do not start setup. Keep the device and its packaging and contact Ledger support for next steps.
- Already using a device from that reseller? Move your assets to a new hardware wallet bought directly from the manufacturer, set up with a completely new recovery phrase. Do not import your old phrase.
- Bought from MediaMarkt or a marketplace seller? Nothing is confirmed yet for these channels. Watch Ledger’s official support site for updates, and if your device came from a third-party marketplace listing or was unusually cheap, consider moving funds to a freshly set up wallet as a precaution.
- Protect your recovery phrase from scammers. Ledger support will never ask for your 24 words. Expect phishing emails, fake ads and lookalike sites that use this news as bait, and only use support.ledger.com for information.
- Buy future devices only from authorized channels. Ledger says devices bought from its own online store are not affected. Researchers noted that some tampered units were offered at close to half the usual price, which is a red flag.
Fake download pages and ads are a common follow-up to news like this. Our guide to spotting fake download ads covers the same warning signs, and our look at malware preinstalled on cheap Android phones explains why supply-chain tampering is so hard to detect.
Who is affected and who isn’t
| Where you bought it | Current status | Suggested action |
|---|---|---|
| CryptoBilis (Malaysia, Indonesia, Philippines) | Tampering confirmed by Ledger on affected devices | Don’t set up; if in use, move funds to a new wallet with a new phrase |
| Marketplace sellers shipping from Malaysia | Researchers obtained tampered units this way | Treat as high risk and move funds as a precaution |
| MediaMarkt / Saturn (Europe) | Buyer reports only; retailer has pulled all Ledger stock | Follow Ledger’s updates; consider moving funds if worried |
| Ledger’s official online store | Ledger says not affected | No action needed beyond normal phishing caution |
Ledger says it has no sign that its own systems or infrastructure were compromised, and that it is working with law enforcement and the SEAL 911 security group. It also says it is developing new protections against physical tampering but has not given a timeline.
FAQ
Which Ledger models are affected?
Ledger has not named specific models. Researchers who examined suspect units described a Ledger Nano X, but the safest assumption is that the sales channel, not the model, is what matters.
Can I tell by looking at my device?
Not reliably. Researchers found one version that replaced the battery and another hidden under the display padding, and opening the case can damage it. Rely on where you bought it rather than a visual check.
Will Ledger replace my device or refund my losses?
Ledger has not announced a replacement or compensation program. Contact Ledger support through its official site and keep your receipts and transaction records.
Sources
- BleepingComputer: Ledger confirms spy chip implant behind wallet crypto thefts
- The Block: Ledger investigates wallet drains involving CryptoBilis buyers
- crypto.news: Ledger confirms hidden chip in crypto wallet
- Cointelegraph: MediaMarkt parent pulls Ledger wallets amid tampering reports
- Cryptopolitan: Second suspect MediaMarkt Ledger
- Ledger Support (official)
Leave a Reply