Key Takeaways
- Ledger investigators discovered that attackers secretly installed hardware implants capable of capturing customers’ 24-word recovery phrases and transmitting them over cellular networks.
- Estimated reported losses have climbed from $86 million to $93 million, but Ledger says the figures remain unverified and confirmed losses involve devices sold through Southeast Asian reseller Cryptobilis.
- European retailer Mediamarkt Saturn has suspended Ledger sales following a separate tampering report in Germany, while rival Trezor is tightening its reseller network amid growing supply chain security concerns.
Ledger Investigation Uncovers Hidden Device That Steals Recovery Phrases
Ledger has been dealing with a catastrophic issue after reports noted that funds were being siphoned from its devices on Oct. 9, 2026. Initially, reports detailed that projected losses amounted to around $86 million, but estimates have since increased to $93 million. Four days later, Ledger has taken to X to explain how its investigation centers on devices sold by Cryptobilis, a reseller operating in Southeast Asia.
The announcement on Tuesday explains that the most important discovery is that the attackers installed a tiny spying device inside the Ledger wallet itself. This device could secretly read a customer’s 24-word recovery phrase and transmit it to the attackers over a cellular network. According to Ledger’s security research team, known as Donjon, the attack involved several steps.
“Based on the Donjon’s analysis of the attack, the implant sits inside the enclosure and reads the data shown on the screen,” Ledger said. “During setup, the signer displays the 24-word recovery phrase. When the implant detects these screens, its microcontroller decodes the words and transmits them over LTE using a provisioned eSIM.”
The company continued:
“The implant is a separate component. It does not modify the Secure Element or the Ledger operating system, and it does not alter transactions or signatures.”
All confirmed fund losses associated with the incident disclosed on Oct. 9 involve wallets purchased through Cryptobilis, the wallet maker said. “We have not confirmed the total number of affected users or the total value lost,” Ledger explained, noting that estimates like the recent $93 million are “not fully verified.”
Ledger is urging anyone who purchased a wallet from Cryptobilis to take precautions. Customers who haven’t activated their devices should avoid setting them up, the company insisted.
Mediamarkt Halts Ledger Sales as Tampering Allegations Spread
In another update, Ledger also said that another reseller, Mediamarkt Saturn, has temporarily stopped selling Ledger hardware wallets. “The sale of Ledger devices in their stores and online while the investigation continues,” the company explained.
Ledger’s announcement concerning Mediamarkt follows a wave of allegations circulating on X, where several accounts claim that Ledger hardware wallets purchased from the European retailer had been physically tampered with.
Ledger said the Mediamarkt pause followed a “report of an implant from one customer in Germany,” but further stressed that “no loss of funds were reported.” The company’s latest statement offered little in the way of substantive clarification, leaving public concerns largely unresolved as speculation and waves of reports continue to circulate across social media. The firm’s competitor Trezor also announced on Tuesday that it was scaling back its resale partners in the wake of Ledger’s incident.
