Ledger Says Covert LTE Implant Stole Hardware Wallet Recovery Phrases From Screens

What to Know

• Ledger said some hardware wallets sold by Southeast Asian reseller CryptoBilis contained a covert implant that captured recovery phrases from device screens.
• The implant allegedly used a microcontroller to recognize and decode 24-word recovery phrases when displayed during setup.
• Ledger said the captured words were transmitted to attackers over LTE using an eSIM.
• The company described the episode as a physical supply-chain attack, not a compromise of its software, internal systems, secure element, operating system or transaction-signing process.
• Ledger said every confirmed loss in the Oct. 9 incident involved a device sold by CryptoBilis.
• Onchain researchers estimated that more than 300 wallets lost up to $93.2 million.
• Tether froze $10 million of USDT tied to the theft, according to the onchain estimates cited by market participants.
• Ledger said CryptoBilis has stopped selling Ledger signers and warned customers who bought from the reseller not to initialize unused devices.

Ledger Details a Physical Supply-Chain Attack

Ledger said a covert hardware implant hidden inside some of its crypto wallet devices sold by CryptoBilis captured users’ recovery phrases from the device screen and transmitted them to attackers over a mobile phone network. The disclosure gives the crypto market a clearer explanation of how funds were allegedly drained in the CryptoBilis-linked thefts, while also drawing a sharp line between a tampered physical product and a breach of Ledger’s core systems.

The company described the incident as a physical supply-chain attack. In Ledger’s account, the unauthorized component was placed inside the device enclosure and activated when a user initialized the signer. During wallet setup, the device screen displays a recovery phrase. Ledger said the implant’s microcontroller recognized and decoded those words, then sent them out over LTE, a data transmission technology used by cellphones, using an eSIM.

That distinction matters because hardware wallets are built around the idea that private keys remain isolated from internet-connected devices. Ledger said the attack did not compromise its software, internal systems, secure element, operating system or transaction-signing process. It also said the implant did not alter transactions or signatures. Instead, attackers targeted the moment when the recovery phrase appeared on the screen, a step that is essential to wallet backup but extremely sensitive if exposed.

Why the Recovery Phrase Was the Critical Target

A recovery phrase is the master key to a crypto wallet. If someone obtains it, that person can recreate the wallet elsewhere and move the funds without needing the original device. That is why wallet makers repeatedly warn users to write down the phrase offline, never photograph it, never store it in cloud services and never type it into a website or application unless they are intentionally recovering a wallet in a trusted environment.

In this case, Ledger said the phrase was not stolen through a phishing page, malware on a computer or a user voluntarily sharing the words. The alleged implant captured the words directly from the device screen during the setup flow. For crypto holders, that detail is particularly troubling because the device screen is generally treated as the trusted display for wallet operations. If a physical implant can read what appears on that screen, the user may have no visible sign that the recovery phrase has been exposed.

The 24-word recovery phrase cited by Ledger is designed to allow a wallet owner to recover access if a device is lost, damaged or replaced. It is also a single point of failure if copied by an attacker. Once the words are known, the attacker does not need to defeat the secure element, change a signature, compromise a computer or steal the hardware wallet itself. The attacker can simply import the phrase into another wallet and transfer assets away.

Loss Estimates Reach Up to $93.2 Million

Ledger has not confirmed the total number of victims or the total value stolen. Onchain researchers, however, estimated that more than 300 wallets lost up to $93.2 million. Those estimates place the event among the more severe hardware-wallet-related incidents discussed by crypto security watchers, not because the device maker’s software systems were said to be breached, but because the alleged attack targeted a trusted product before it reached or while it was handled by the end user.

The estimates also indicate that Tether froze $10 million of its dollar-pegged stablecoin USDT tied to the theft. Stablecoin freezes can limit the movement of some stolen funds when the issuer is able to identify associated tokens and act within its controls. However, freezing one portion of assets does not necessarily recover the full amount or prevent movement of other crypto assets that may not have similar centralized intervention mechanisms.

For victims, the practical consequence is straightforward: if a recovery phrase was exposed, the wallet can no longer be considered secure. Even if the physical device continues to operate normally, and even if signatures look valid, the phrase may already have been copied. Security professionals generally treat any exposed seed phrase as permanently compromised, meaning funds should be moved to a wallet generated from a new recovery phrase on a trusted device.

Ledger Says Core Security Architecture Was Not Breached

Ledger said the implant did not modify the device’s secure element, the chip designed to protect private keys. It also said the operating system was not altered, transactions were not changed and signatures were not manipulated. That framing is central to Ledger’s position because the company is emphasizing that the attack took place through physical tampering, not through a failure of its transaction-signing model or a breach of its internal infrastructure.

Hardware wallets are intended to reduce exposure to compromised computers and mobile phones by keeping sensitive signing operations inside a dedicated device. The secure element plays a major role in that model. But no hardware-wallet design can protect a recovery phrase if the phrase is observed at the moment it is generated or displayed. That is why the setup process, device packaging and reseller chain all become part of the security boundary.

Supply-chain attacks are especially difficult for users because the device may look legitimate, boot normally and display expected prompts. A malicious component hidden inside the enclosure can be invisible without specialized inspection. Ledger said it confirmed one affected signer contained an unauthorized implant and is examining reports of implants in other devices and locations. The company also said it has not verified a theft involving a signer purchased elsewhere.

CryptoBilis Devices at the Center of Confirmed Losses

Ledger said every confirmed loss in the Oct. 9 incident involved a device sold by CryptoBilis. The reseller, based in Southeast Asia, has stopped selling Ledger signers, according to Ledger. The company’s warning to customers is direct: anyone who bought a device from CryptoBilis and has not initialized it should not initialize it.

For customers who already used one of the devices, Ledger said assets should be moved to a new device with a newly generated recovery phrase. That guidance reflects the security reality of seed compromise. A replacement device is not enough if the same recovery phrase is reused. The new wallet must be created from a fresh phrase that was not displayed on, generated by or entered into a potentially compromised signer.

The incident also reinforces a broader lesson for crypto users: the point of purchase matters. Hardware wallets are physical security products, and their integrity depends on the full path from manufacturer to user. Authorized distribution channels, sealed packaging, device authenticity checks and cautious initialization procedures all play a role, but a sophisticated physical implant can still raise difficult questions about how wallets are handled before they reach customers.

Market Impact and Security Implications

The crypto market has seen many forms of theft, including exchange hacks, bridge exploits, phishing campaigns, wallet-draining websites and malware. This incident stands out because it involves an alleged covert cellular implant inside hardware wallet devices. The use of LTE and an eSIM suggests an attack designed to avoid reliance on the victim’s computer or local network. If the implant could transmit directly over a mobile network, the attacker would not need to wait for the user to connect the device to a compromised machine.

For institutional desks, treasury teams and long-term holders, the case highlights the importance of procurement controls. Secure custody is not only about choosing a well-known wallet brand or storing phrases offline. It also involves verifying vendors, maintaining chain-of-custody procedures, segregating duties and responding quickly if a particular batch, reseller or device source becomes associated with confirmed losses.

For retail users, the immediate takeaway is more basic but equally important. A hardware wallet protects against many online threats, but it cannot protect funds if the recovery phrase is captured during setup. Users who purchased a device from a reseller associated with confirmed losses should follow the manufacturer’s instructions, avoid initializing unused devices and move funds away from already used devices with a newly generated phrase on a trusted replacement.

Frequently Asked Questions (FAQs)

What did Ledger say happened?

Ledger said a covert implant inside some hardware wallets sold by CryptoBilis captured users’ recovery phrases from device screens and transmitted them to attackers over LTE using an eSIM.

Was Ledger’s software compromised?

Ledger said its software, internal systems, secure element, operating system and transaction-signing process were not compromised. The company described the event as a physical supply-chain attack.

Why is a recovery phrase so important?

A recovery phrase is the master key to a crypto wallet. Anyone who has it can recreate the wallet elsewhere and move funds without needing the original Ledger device.

How many wallets were affected?

Ledger has not confirmed the total number of victims. Onchain researchers estimated that more than 300 wallets lost funds in the CryptoBilis-linked thefts.

How much crypto was stolen?

Ledger has not confirmed the total value stolen. Onchain researchers estimated losses of up to $93.2 million, with Tether freezing $10 million of USDT tied to the theft.

Which seller was linked to the confirmed losses?

Ledger said every confirmed loss in the Oct. 9 incident involved a device sold by CryptoBilis, a Southeast Asian reseller that has stopped selling Ledger signers according to Ledger.

What should customers with unused CryptoBilis-sold devices do?

Ledger said customers who bought a device from CryptoBilis and have not initialized it should not initialize it.

What should customers do if they already used one?

Ledger said customers who already used one should move assets to a new device with a newly generated recovery phrase, because a potentially exposed phrase should not be reused.

Did the implant alter transactions?

Ledger said the implant did not alter transactions or signatures. The alleged attack focused on capturing the recovery phrase when it appeared on the device screen.