# Ledger Confirms Malicious Parts in CryptoBilis Hardware Wallets

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/30870
Published: 2026-10-13T06:57:07.000Z
Updated: 2026-10-13T06:57:07.000Z
Section: Technology

> The components could capture 24-word recovery phrases and transmit them over LTE. Confirmed losses tied to the Oct. 9 incident involved CryptoBilis-sold devices.

Ledger confirmed that hardware wallets sold by Southeast Asian dealer CryptoBilis contained unauthorized components capable of capturing users’ 24-word recovery phrases and transmitting them over LTE.

Ledger’s security team, Ledger Donjon, identified the issue through a device belonging to one affected user on Oct. 10. The implanted component was located inside the device casing and could read information displayed on the screen.

During initial setup, the component could decode the recovery phrase and send it externally through a built-in eSIM connection. The component did not modify the device’s security chip, operating system or transaction-signing process.

All confirmed funds lost in the incident disclosed Oct. 9 were linked to devices sold by CryptoBilis. The dealer has stopped selling Ledger devices. The number of affected users and total losses have not been established.

Ledger is also examining reports of similar implanted components involving other dealers and regions.