Ledger Says Hidden Implant Sent Recovery Phrases Over LTE

The implant Ledger found in a wallet sold by reseller CryptoBilis left the device's best-guarded chip completely alone. It didn't try to break any cryptography. It waited for the one moment a hardware wallet shows its secret in plain view: the recovery phrase screens during setup.

Ledger says every confirmed loss so far involves a device sold by CryptoBilis, and it hasn't verified a drain linked to a signer bought anywhere else. It hasn't confirmed how many people were affected or how much was lost. CryptoBilis has stopped selling Ledger devices while the investigation continues.

How the Implant Read the Recovery Phrase

A quick tour of the parts first. A Ledger keeps your keys in a Secure Element, a dedicated chip built to hold secrets and sign transactions without letting them out. Ledger OS is the software that runs the device. When you set up a new signer, it shows you a recovery phrase: a list of words that can rebuild your wallet on another device.

The implant is a separate component added to the hardware. Ledger's account of its findings says it carries its own microcontroller, a small chip that runs one job. When that chip detects the recovery phrase screens during setup, it decodes the words and sends them out over an LTE mobile connection, using a provisioned eSIM. That's a built-in SIM already set up to reach a mobile network.

That last detail is the unsettling one. A hardware wallet is supposed to sit offline. This one had a phone line of its own that the owner never knew about, so it didn't need your computer or your Wi-Fi to send anything anywhere.

Why the Secure Element Didn't Stop It

Ledger says the implant doesn't modify the Secure Element or Ledger OS, and doesn't alter transactions or signatures. Every transaction the device signed was the one its owner approved. The attacker had no reason to interfere with those. With the recovery phrase in hand, the whole wallet could be rebuilt somewhere else.

It also explains why Ledger's built-in authenticity test wasn't a safety net here. Ledger's own support page says the Genuine Check can't detect physical spying implants if the original Secure Element remains intact. This implant was designed to leave it intact.

What Ledger Is Telling CryptoBilis Buyers

Ledger's advice to people who bought from CryptoBilis splits on one question: have you set the device up yet?

• If you haven't, don't. Contact Ledger Support instead.
• If you have, move your assets promptly to a new device with a new recovery phrase.
• Either way, don't enter or restore any recovery phrase on a device bought from CryptoBilis.

Checking a Device You Already Own

Ledger's inspection guide shows the official internal layout of its devices, so owners can check that no third-party components have been added. For Stax, Flex and Nano Gen5, the listed microcontroller is an STM32WB35.

There's a catch built into the design. The Nano Gen5 has a one-piece, tamper-evident casing that can't be opened without visible, irreversible damage, and any damage from opening or inspecting a device voids the warranty. The same casing that makes tampering obvious makes a home inspection costly. Ledger's broader advice is to buy from the official Ledger Shop or authorized retailers, and it says buying from unlisted sellers introduces material security risks.

Who Installed the Implants Remains Unknown

The biggest gaps are still open. Nobody has established how the implants got into the devices, who installed them, or which Ledger models were affected. Ledger hasn't confirmed the number of victims or a total loss, and outside estimates of the damage differ. You can catch up on those figures in our coverage of the drain claims.

Reports of tampered devices bought from other sellers are circulating, but none has been verified. For now, Ledger's line holds: every confirmed drain traces back to a CryptoBilis device, and the attack worked by reading the phrase off the screen, not by breaking the chip behind it.