Tampered Ledger Wallets: How the Hidden Implant Steals Seed Phrases

In October 2026, Ledger confirmed that tampered Ledger Nano X hardware wallets sold through the third-party reseller CryptoBilis contained a hidden implant: a cellular modem, an eSIM and an antenna that read the 24-word recovery phrase from the screen during setup and sent it to the attackers. On-chain analysts at Bitquery counted about $102 million drained from 324 wallets. If you bought a Ledger from a reseller, do not use it until you have checked it, and move funds to a device bought directly from the manufacturer.

Summary

• The implant does not attack Ledger’s Secure Element, the chip that stores private keys. It reads the recovery phrase from the display connection and sends it out over a mobile network.
• Ledger tied the confirmed thefts to devices bought from CryptoBilis, a reseller serving Malaysia, Indonesia and the Philippines, and said its own sales channels were not affected.
• The drains started on October 9, 2026, on TRON and spread to five more blockchains within an hour. Bitquery’s count reached about $102 million across 324 wallets by October 12.
• Tether froze about $10 million in USDT linked to the attacker’s wallets, according to Bitquery.
• Similar implants were later reported in a Nano X bought at MediaMarkt in Germany and a Ledger Flex bought from a Singapore reseller. Ledger said it found no tampering in the German stock it inspected.

How does the Ledger hardware implant work?

The implant captures the recovery phrase at the only moment it is shown in full: initial setup. Whoever holds that phrase can rebuild the wallet on any device and move the funds.

Mark Karpelès, former CEO of the Mt. Gox exchange, opened a shrink-wrapped Nano X bought in Malaysia and published what he found:

1. Hidden hardware: a small board with a microcontroller, an LTE cellular modem, an eSIM and an antenna, placed inside the original casing.
2. Screen tap: the board is wired to the display bus (SPI), so it sees what the device draws on the screen.
3. Capture: when the device shows the 24-word recovery phrase during setup, the implant records it.
4. Exfiltration: the modem sends the phrase to the attacker over a 4G mobile network, with no help from the user’s phone or computer.
5. Theft: the attacker restores the wallet elsewhere and drains it, at a time of their choosing.

The Secure Element was intact on the devices examined. Ledger’s Genuine Check verifies that chip, so a passing check does not rule out this kind of tampering.

Ledger Support statement on X about the tampered devices

Which Ledger devices and resellers are affected?

The confirmed thefts are tied to Ledger Nano X devices bought from CryptoBilis. Ledger asked CryptoBilis to stop sales, and the reseller halted all hardware wallet sales and closed its channels.

Ledger also asked sellers in seven Asian markets, including Singapore, to pause sales while it investigates.

How much crypto was stolen in the Ledger implant attack?

Bitquery’s updated on-chain count put the losses at about $102 million from 324 wallets as of October 12, 2026. Earlier estimates ranged from $86 million to $93 million before more drained funds were found. Ledger has not confirmed a total.

The drains started on TRON on October 9, 2026, at about 04:59 UTC, and the same attacker emptied wallets on five more chains within 47 minutes. The breakdown below is Bitquery’s:

Tether froze about $10 million in USDT across 20 of the attacker’s wallets. A freeze stops the tokens from moving, but it does not return them to victims.

How can you check if your Ledger has been tampered with?

The only reliable check is a physical one. Do these before you set up a device, and before you move funds onto a device you already use:

1. Check where you bought it. Devices from CryptoBilis, or any reseller Ledger has asked to pause sales, should be treated as compromised until checked.
2. Weigh it. A Ledger Nano X weighs 34 grams. Attackers swap in a smaller battery to offset the implant, so the difference can be very small. Use a precision scale, not a kitchen scale.
3. Inspect the casing. Look for glue marks, gaps, scratches near the seams or signs the plastic was pried open.
4. Open it if you can. Compare the circuit board with Ledger’s reference images of genuine boards and look for extra chips or a non-standard battery.
5. Assume the phrase is exposed if in doubt. If a device is suspect, generate a new recovery phrase on a device bought directly from the manufacturer and move the funds.
6. Buy direct. Order hardware wallets from the manufacturer’s official store, not from marketplaces or third-party resellers.

What scams follow a hardware wallet incident?

Attackers use the news to reach worried owners. After an incident like this, expect fake Ledger emails and texts offering a “free replacement”, “security check” or “recall”, fake support accounts on X and Telegram, and lookalike sites or fake Ledger Live apps that ask for the 24-word recovery phrase.

Ledger will never ask for your recovery phrase. Any page, app or person that asks for it is a scam, however official it looks.

Crypto brands are frequent impersonation targets. In PhishFort’s Digital Threat Intelligence Report for January to June 2026, Crypto and DeFi accounted for 14.4% of confirmed brand impersonation cases (PhishFort internal data).

How PhishFort helps crypto brands after an incident

Follow-up phishing is the part of an incident a crypto company can act on fast. PhishFort Brand Protection for crypto removes phishing sites, cloned dApps, fake wallet apps, and impersonator accounts that target crypto exchanges, wallets, and Web3 projects, including the fake support accounts and recovery phrase scams that follow an incident like this one.

Frequently asked questions

Sources

• Ledger Support statement on X: https://x.com/Ledger\_Support/status/2108551100613714002
• BleepingComputer, “Ledger confirms spy chip implant behind wallet crypto thefts”, October 2026.
• Daily Security Review, “Tampered Ledger Nano X devices tied to CryptoBilis”, October 12, 2026.
• Altcoin Buzz on Bitquery data, “Tether freezes $10M in USDT linked to CryptoBilis Ledger drain”, October 13, 2026.
• Unchained, “Mark Karpelès says Ledger spy implant turned up in devices from 2 more authorized resellers”, October 16, 2026.
• PhishFort Digital Threat Intelligence Report, January to June 2026 (PhishFort internal data).