Ledger Finds LTE Implant That Stole $86M in Recovery Phrases

Ledger’s Donjon security team has confirmed the presence of an unauthorized LTE hardware implant in a Ledger hardware wallet sold by Southeast Asian reseller CryptoBilis. The implant reads the 24‑word recovery phrase displayed on the device during setup and transmits the data over a provisioned eSIM, leaving the Secure Element and Ledger’s operating system untouched. Ledger verified the implant on a single user’s device and has not disclosed the total number of affected wallets or the exact amount lost, though on‑chain analysis by Specter traced more than $86 million in suspected thefts across Ethereum, Tron and Bitcoin.

How the Implant Works

The implant is a separate microcontroller embedded inside the wallet’s enclosure. When the device displays the recovery phrase, the implant’s sensor captures the screen content, decodes the words, and sends them via LTE to an external server. The device’s Secure Element and firmware remain unaltered, meaning transaction signatures are not compromised.

Impact and Response

CryptoBilis has halted sales of Ledger devices while the investigation continues. Ledger advises users who purchased from CryptoBilis not to set up the device, to contact Ledger Support, and to move any assets to a new wallet with a fresh recovery phrase. Users with compromised devices should file police reports and avoid opening the device before speaking with support.

Key facts

• Unauthorized LTE implant found in Ledger device sold by CryptoBilis.
• Implant captures 24‑word recovery phrase and transmits it via eSIM.
• No modification to Secure Element or Ledger OS.
• Suspected thefts exceed $86 million across multiple blockchains.
• Ledger urges affected users to migrate funds and report to law enforcement.