Ledger confirmed on October 13, 2026 that at least one of its hardware wallets sold through CryptoBilis, a reseller in Southeast Asia, had a hidden implant inside the casing that read the 24-word recovery phrase off the screen during setup and sent it out over a mobile network. Funds were drained from affected wallets on October 9, and because the implant left the device’s secure chip untouched, a tampered unit can still pass Ledger’s own authenticity test.
That last detail is why this matters if you hold crypto in Nigeria and keep it on a Ledger, or plan to buy one. Ledger devices aren’t something most people here pick up from a local shop with a manufacturer’s receipt, so many arrive through importers, social media vendors, foreign marketplaces or a relative coming back from a trip. Each extra pair of hands between the factory and you is a place where a device like this could be opened and resealed, and the usual reassurance of running the Genuine Check isn’t enough on its own anymore.
| Confirmed by Ledger | 13 October 2026, investigation update |
|---|---|
| Reseller involved | CryptoBilis (Southeast Asia), sales now paused |
| What the implant did | Read the recovery phrase from the screen at setup and sent it over LTE via an eSIM |
| Secure chip and firmware | Not modified, according to Ledger |
| Funds drained | 9 October 2026 |
| Estimated losses | Third-party estimates above $90 million across 300+ wallets; not verified by Ledger |
| Models affected | Not confirmed |
Why a clean Genuine Check didn’t catch this implant
Ledger’s Genuine Check works by confirming a cryptographic certificate stored in the Secure Element, the protected chip that holds your keys. According to Ledger’s investigation update, the implant sat elsewhere in the enclosure and didn’t alter the Secure Element, the operating system, or the transactions you sign. It simply watched the display at the one moment your recovery phrase appears in full, which is during first setup, and that’s how a device could look perfectly authentic to the software while leaking the one thing that gives an attacker your coins.
Ledger hasn’t said how many devices were affected or named specific models, and it has been careful about the money involved, saying “Figures circulating online come from third parties and Ledger has not fully verified them”. It also says it’s reviewing reports of implants in other devices and locations. In Germany, the electronics chain MediaMarkt Saturn stopped selling Ledger devices on October 13 after a customer reported a suspected tampered unit, though Ledger says no funds were lost in that case. Chief technology officer Charles Guillemet said “Ledger is reviewing its reseller controls and anti-tamper protections”.
Where your Ledger came from now matters more than the box it came in
Ledger’s own buying guidance tells customers to favour official Ledger storefronts or authorised resellers, and it keeps an official reseller list you can check against whoever is selling to you. A vendor in Lagos or Abuja may be perfectly honest and still have bought stock from a chain they can’t vouch for, so the question to ask before paying isn’t whether the seller seems trustworthy but whether they can show the device came from Ledger or a reseller on that list. If they can’t, ordering directly from Ledger and paying the shipping and clearing costs is the safer route, even if it takes longer.
We’ve written about checking whether a JBL speaker is original and how to spot a genuine Oraimo product, and with those the worst case is a poor speaker or a charger that dies early. A tampered hardware wallet is different because the damage isn’t to the device but to everything you put on it, and it may not show until the day your balance is gone.
Already set one up? Ledger’s advice depends on where you bought it
If your device came from CryptoBilis, which sells in Malaysia and neighbouring markets and may have reached Nigeria through someone who bought abroad, Ledger’s instruction is direct: “If you bought a Ledger signer from CryptoBilis and have not set it up, do not set it up and contact Ledger Support.” If you’ve already used one, Ledger advises moving your assets promptly to a new device with a freshly generated recovery phrase, and if you’ve lost funds it says “coordinate with law enforcement before opening the signer” so evidence isn’t destroyed.
If you bought from Ledger directly or from a listed reseller, nothing Ledger has published so far suggests you need to act. If you bought from a source you can’t trace, the cautious step is to set up a new device bought through an official channel and move your funds to its new recovery phrase, rather than restoring your old phrase onto it, because a phrase that may have been read once should be treated as exposed.
Buy it if
- Buyers who can order directly from Ledger or from a reseller on its official list
- Anyone holding enough crypto that an exchange account feels too risky
Skip it if
- Anyone offered a cheap unit by a vendor who can't say where it came from
- Second-hand or open-box devices of unknown history
- Buyers in a hurry who can't wait for an official shipment
The implant targeted the supply chain, not Ledger's chip, so a Ledger from an official channel is still a sound choice. An untraceable one isn't worth the saving.
Ledger is still investigating where in the distribution chain the tampering happened, and more models or resellers could be named in the coming days. Until that’s settled, the receipt showing where your wallet came from is worth almost as much as the wallet itself, and if you don’t have one, spending on a new device from an official source costs far less than what an attacker could take.
Join the conversation