Ledger Wallet Tampering: What Is Confirmed and What Owners Should Know

As of Oct. 14, 2026, at 11:32 a.m. ET.

Ledger says hardware wallets sold through Southeast Asian reseller CryptoBilis contained unauthorized implants that read recovery phrases from the screen and transmit them over a cellular connection. The company's technical account describes physical tampering, with the original security chip and operating system left unchanged.

For owners, the distinction matters: a genuine Ledger chip does not prove that the rest of a device is free of spying hardware. Ledger says its Genuine Check cannot detect these modifications when the original chip remains in place.

The scope is still under investigation. In an Oct. 14 statement, Ledger said it had not verified a fund drain linked to a device bought outside Southeast Asia. Reports of modified devices in other sales channels are a separate question from confirmed thefts.

What Has Ledger Confirmed About the Attack?

On Oct. 10, Ledger Support confirmed that one affected user's device contained an “unauthorized hardware implant.” Its Oct. 13 technical update, citing its Donjon security team, explained how the attack works.

During setup, the wallet displays a 24-word recovery phrase. According to Ledger, the added component reads the screen data, decodes the words and transmits them over LTE using an eSIM. It does not modify the Secure Element—the device's security chip—or Ledger's operating system, and does not alter transactions or signatures.

The theft target is the wallet's backup secret. As Ledger's recovery-phrase documentation explains, the phrase can recreate the private keys and accounts without the original device. Restoring an exposed phrase on replacement hardware recreates the same keys; it does not revoke an attacker's access. That is why Ledger's instructions specify a new recovery phrase, not just a new device.

In its Oct. 13 regional update, Ledger said it had no indication that its infrastructure, systems, services or direct sales channel had been compromised. That is not a guarantee about every individual wallet.

Which Sales Channels Are Involved?

CryptoBilis is the channel Ledger initially linked to confirmed losses. On Oct. 13, Ledger said all confirmed fund losses tied to the incident involved CryptoBilis-sold devices. On Oct. 14, it described the affected sellers as “a limited number of resellers,” without naming them in that statement, and reiterated that it had not verified a drain linked to a purchase outside Southeast Asia. The later wording does not provide a complete list of affected sellers.

Other public reports concern the presence of implants, rather than Ledger-confirmed fund losses:

• MediaMarkt purchases in Europe: A buyer posting as Johannes reported an implant on Oct. 11. On Oct. 12, he said a second device from a different MediaMarkt store contained “additional cables and an LTE module.” Ledger acknowledged a German customer's implant report on Oct. 13 and said no fund losses were reported in that case.
• Singapore airport: Mark Karpelès, who examined a Ledger Flex sent to him by buyer Ben Yorke, said it contained a spy implant. Yorke identified the seller as Metapod and said he bought it in late June. The purchase history and implant finding are their accounts, not a Ledger-confirmed theft.
• Amazon Japan marketplace: Karpelès said a discounted Nano X he bought on Amazon Japan contained an implant. In an Oct. 14 response about those reports, Ledger said the devices were bought from third-party resellers, not directly from Amazon.

A reported purchase channel does not establish who installed an implant. Ledger says it is still investigating who tampered with the devices and where in the distribution chain it happened.

Timeline: From Loss Reports to Sales Suspensions

These are dates of public statements and actions, not established dates when devices were tampered with. All dates are in 2026, in ET.

• Oct. 9: Ledger disclosed an investigation into fund-loss reports involving CryptoBilis customers and asked the reseller to pause Ledger sales and shipments.
• Oct. 10: Ledger confirmed an implant in one affected user's device and said CryptoBilis had halted all hardware-wallet sales pending the investigation. The Defiant covered that initial confirmation.
• Oct. 11–12: Johannes reported two allegedly modified MediaMarkt purchases, bringing a European retail channel into the public accounts. The Defiant's first report distinguished his claim from Ledger's confirmed loss cases.
• Oct. 13: Ledger published the LTE mechanism and said MediaMarktSaturn had stopped sales in stores and online with its agreement. Later, it asked resellers and distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales and take products off shelves. The Defiant reported the regional request.
• Oct. 14: Ledger reiterated the Genuine Check limitation and said it had not verified a drain linked to a device bought outside Southeast Asia.

The regional announcement was a request to suspend sales; it did not establish that every reseller had complied. It also did not announce a blanket recall or set out refunds or replacements for devices already sold.

What Should Owners Do?

Ledger's instructions depend on the purchase channel and whether the device has been set up. Its Oct. 14 guidance for CryptoBilis buyers says:

• Not yet set up: Do not initialize the device. Contact Ledger Support for next steps.
• Already set up: Transfer assets as soon as possible to a new device secured by a new recovery phrase. Do not enter or restore any recovery phrase on a CryptoBilis-bought device.

For buyers elsewhere who have concerns, Ledger points to its hardware-integrity guide and official support. It warns that opening a device can damage it and says to back up the recovery phrase first. A successful Genuine Check alone cannot rule out the implant described in this investigation.

People who lost funds or hold a tampered device should contact Ledger Support and file a report with local law enforcement, according to the company's Oct. 13 instructions. Ledger says not to send the device to anyone before speaking with support or law enforcement. Those who lost funds should coordinate with law enforcement before opening it.

Ledger also warns owners never to enter a recovery phrase into a website, app or form. The company says it will never call, send a direct message or ask for those 24 words.

What Remains Unresolved?

Ledger said in its Oct. 13 technical update that it had not confirmed the total number of affected users or total value lost, and had not fully verified third-party figures circulating online.

The origin and extent of the tampering remain open. In an Oct. 14 response, Ledger said it could not comment on individual resellers' supply chains while investigating. Its Donjon team is to analyze devices it receives. Those findings are needed to establish where the implants entered distribution and which additional devices or channels, if any, were affected.