Implant in CryptoBilis Wallets Transmitted Seed Phrases via LTE

A recently discovered hardware implant in crypto wallets sold by the reseller CryptoBilis could intercept users' seed phrases and transmit them to attackers via the LTE mobile network. This was reported by the Ledger security team in an update published on October 10, 2026. The implant was located inside the wallet's casing and read information from the device's screen during its initial setup. When the user was shown the 24-word seed phrase, the implant recognized, decoded, and sent the information to attackers via a secure eSIM. This module did not alter the Secure Element chip, the Ledger operating system, or affect transactions. As of October 9, 2026, all confirmed losses of funds were linked only to devices sold through CryptoBilis. However, Ledger is also investigating other devices outside of Asia.

According to estimates by the analytics company Bitquery, attackers have already withdrawn $93.2 million from 315 crypto wallets across six blockchains, while other researchers pointed to 530 affected addresses with a total damage of $103.4 million. In response to the incident, CryptoBilis has suspended sales and shipments of Ledger-branded hardware wallets in countries such as Indonesia, Malaysia, and the Philippines. The company has also temporarily closed physical stores. Additionally, well-known crypto-security researcher Mark Karpeles confirmed the presence of the implant in a Ledger Flex device purchased at Singapore airport. Despite these reports, Ledger has not yet confirmed a connection between this incident and CryptoBilis.

Using the implant, an attacker could restore access to the wallet on another device without physical access to the original wallet. Ledger strongly recommends that users who purchased their wallets from CryptoBilis not set up new devices and, if already set up, immediately transfer assets to a new device with a new seed phrase. The main condition – do not enter or restore the seed phrase on wallets purchased from CryptoBilis. If you have fallen victim to fraud or have a modified device, contact Ledger support and local law enforcement. The company continues its investigation and will provide updates as they become available.