Ledger investigates CryptoBilis wallet drains and discloses a hardware implant
Warnings beginning October 9 developed into an explanation of how tampered devices could capture recovery phrases during setup.
Ledger began investigating wallet-drain reports on October 9, 2026, and asked Southeast Asian reseller CryptoBilis to stop selling and shipping its devices. Subsequent statements linked confirmed cases to that reseller. By October 13, the company described an unauthorized implant that captured recovery words displayed during setup and transmitted them over a mobile connection.
A recovery phrase can recreate the keys controlling a wallet. Capturing it undermines the protection normally gained by keeping signing keys inside a separate device: an attacker who learns the words can restore the wallet elsewhere and spend its funds. The reported mechanism concerned physical tampering around the device and its display, rather than a break in Bitcoin's signature system.
The sequence moved from reports of losses to identification and explanation of a hardware modification. It made the distribution chain part of the custody problem. Obtaining an authentic product design was insufficient if a unit could be altered before the owner initialized it.
The initial warnings and later mechanism disclosure described one developing incident. They did not establish that all Ledger devices or all sales channels were compromised. The episode exposed a specific failure mode in which hardware intended to isolate secrets became the means of observing them at their creation.