Updated 24 October 2026 at 14:30 (Paris time) · ~6 min read
What was observed
According to Ledger and published analyses, devices resold through the intermediary CryptoBilis contained a hardware implant housed in the enclosure. During setup, the implant read the 24 words displayed on screen, decoded them and transmitted them over LTE using an embedded eSIM.
The implant modifies neither the secure element nor the operating system, and does not alter transactions or signatures. That separation matters: a software authenticity check may still pass while the enclosure has been tampered with.
Confirmed cases involve devices sold by this reseller in Southeast Asia. Ledger states that its systems, OS and chips were not compromised.
What this does not prove
That a new Ledger bought through an official channel and left unmodified silently transmits its recovery phrase. To our knowledge, no reproducible public evidence establishes this today. Such a claim must be tested on an identified device, with a version and a reproducible protocol.
Why this case matters
The threat is not only in firmware. It can be in a component added before sale, invisible to the user and to some authenticity checks. That is precisely the purpose of RF-WALLET: analyse emissions, inspect hardware, look for implants and distinguish a real leak from a narrative.
Analysis framework
This analysis is independent and based on public sources. It is not an audit commissioned by Ledger and does not claim to cover all of its products.
Sources
The Record, “Ledger says hardware implant in cryptocurrency wallets stole recovery phrases”, 13 October 2026 — therecord.media.
The Hacker News, “Ledger Finds Unauthorized Hardware Implant in CryptoBilis-Sold Wallet Amid Fund Theft Reports”, 12–13 October 2026 — thehackernews.com.
Public communications from Ledger, October 2026.