Ledger CryptoBilis implant: seed phrases sent over LTE

Not stated by Ledger. Ledger: "We have not confirmed the total number of affected users or the total value lost." Third-party figures disagree: Specter >$86M (via Decrypt), up to $93.2M (on-chain researchers via CoinDesk), $102.0M from 335 wallets (Bitquery).

Root cause: Per Ledger Donjon: an implant inside the enclosure reads the screen, decodes the 24-word recovery phrase shown during setup, and transmits it over LTE via a provisioned eSIM. Secure Element and OS not modified.

Timeline, as sourced: Losses disclosed by Ledger on 9 Oct 2026; implant confirmed on one signer 10 Oct 2026; Donjon technical update posted 13 Oct 2026 06:39 UTC; Ledger blog response dated 15 Oct 2026 (no timezone given).

Ledger says all confirmed fund losses in the incident it disclosed on 9 October 2026 involve signers sold through CryptoBilis, a reseller in Southeast Asia. According to the Ledger Donjon update (opens in a new tab), an unauthorized implant inside the enclosure reads what the screen shows. During setup the signer displays the 24-word recovery phrase; the implant's microcontroller decodes those words and transmits them over LTE using a provisioned eSIM. Ledger says the implant does not modify the Secure Element or the operating system and does not alter transactions. In its blog response (opens in a new tab), Ledger describes the incident as an attack on the distribution channel after devices left its control. Ledger says (opens in a new tab): "We have not confirmed the total number of affected users or the total value lost." Figures in circulation come from third parties and differ.