A hidden chip stole crypto through Ledger wallets

A hidden chip inside a Ledger hardware wallet could read its 24 recovery words and transmit them over a mobile connection. On October 10, 2026, Ledger confirmed that a device belonging to an affected user contained unauthorized hardware. The attack targeted a device designed to protect crypto assets. The problem was not just software. It was the hardware itself. What does this mean for anyone who stores crypto on a Ledger?

A hidden chip sent recovery words outside the device

Ledger is investigating devices sold through CryptoBilis, a reseller in Southeast Asia. On October 9, 2026, Ledger announced that it was investigating reports of missing crypto funds. One day later, the company confirmed that a device belonging to an affected user contained an unauthorized component.

According to the Ledger Donjon update of October 13, 2026, the component was inside the device enclosure. It could detect when the device displayed the recovery words during setup. A microcontroller then decoded the words and transmitted them over LTE, a mobile network connection, using an embedded eSIM.

The chip did not replace Ledger's secure component. According to the company, it also did not change the operating system or digital signatures. The attack was still dangerous. Anyone who obtains your recovery phrase can often use it to move the associated crypto assets.

Ledger has not established the total number of affected users or the overall loss. External sources have cited amounts above $86 million. That figure has not been officially confirmed. CryptoBilis has stopped selling Ledger devices while the investigation continues.

A Ledger stores private keys, not coins

A Ledger is a hardware wallet. This physical device protects your private keys and helps you sign transactions. Your bitcoin or ether does not literally sit inside the device. The blockchain records which addresses control the crypto assets.

Your private keys give you control over those assets. A typical Ledger setup uses a recovery phrase consisting of 24 words. These words act as a backup that can restore access if your device breaks or goes missing.

That is also where the risk lies. Someone who knows your recovery phrase can often restore the wallet on another device and move your crypto. They do not need to steal your physical Ledger.

A hardware wallet is designed to protect private keys from attacks through a computer or phone. But that protection has limits. If someone adds extra hardware before the device is sold, allowing it to read information displayed on the screen, the threat changes.

The CryptoBilis incident therefore highlights more than software security. The manufacturing process, distribution chain and origin of a physical device also matter.

A stolen recovery phrase can cost you your entire balance

Suppose you hold €5,000 in crypto and an attacker obtains your recovery phrase. If that person transfers all your assets, you could lose the entire €5,000. This is not a market decline. It is a loss of control over your holdings.

Partial theft can also be costly. If someone transfers €1,000 from the same portfolio, you would have €4,000 remaining, assuming the rest of your assets were untouched. These are illustrative calculations, not confirmed losses from the CryptoBilis investigation.

Another source of loss is the market itself. A report filed with the US Securities and Exchange Commission in 2026 stated that bitcoin fell from $87,463.03 on December 31, 2025, to $59,101.49 on June 30, 2026. That was a decline of approximately 32.4%.

A hypothetical €1,000 investment exposed to the same percentage decline would be worth about €676. This is a calculation based on a historical price movement, not a forecast. Market losses and theft are different risks, but both can reduce your wealth.

The attack does not prove every Ledger wallet was hacked

Ledger has stated that all confirmed losses linked to this incident involved devices sold through CryptoBilis. The company has not confirmed a comparable theft through this attack involving a device purchased from another seller.

That does not mean every other device is automatically safe. It does mean the confirmed information does not support a claim that all Ledger wallets have been hacked.

Ledger uses a Secure Element, a security chip designed to protect sensitive information, alongside its own software. These protections aim to prevent private keys from leaking. However, the reported attack targeted information visible on the screen during setup.

A device can therefore contain a genuine secure chip and still have an additional unauthorized component. A check that confirms the original chip is genuine does not necessarily prove that the device has never been physically altered.

The origin of a hardware wallet should therefore be part of your security checks, alongside your PIN and recovery phrase.

Ten checks can help protect your crypto

You cannot eliminate every risk, but you can avoid several important mistakes.

1. Check where your hardware wallet came from. Use a seller you have independently verified.
2. If you bought a Ledger through CryptoBilis and have not set it up, do not use it. Contact Ledger Support.
3. If you already set up the device, follow Ledger's official instructions for moving your assets to a new device with a new recovery phrase.
4. Never use a recovery phrase generated for you in advance or supplied with a device.
5. Never enter your 24 recovery words on a website, in an app, in an online form or in a chat.
6. Store your recovery phrase offline in a secure place. Do not photograph it or save it in email or cloud storage.
7. Check the full receiving address and transaction details on your hardware wallet's screen before confirming.
8. Keep your computer and phone updated, and watch out for fake software and phishing.
9. Do not trust unexpected calls or messages from people claiming to work for Ledger.
10. If you suspect your device has been altered, do not open it or send it away before speaking with Ledger Support or the police.

Ledger warns that it will never call or message you directly to ask for your 24 recovery words. Never share those words with anyone, including someone who claims to be helping you.

European rules do not automatically reimburse your losses

The European Union's MiCA regulation has applied since December 30, 2024, to the relevant types of crypto assets and service providers. The rules establish requirements for certain providers, but they do not mean every crypto transaction is insured or that a stolen wallet will automatically be reimbursed.

On October 6, 2025, the European supervisory authorities ESMA, EBA and EIOPA warned that consumer protection depends on the type of crypto asset and the service provider involved. Protection may also be limited when a provider falls outside the relevant European rules.

Dutch and Belgian users are subject to the same basic EU rules for services covered by MiCA. The rules governing a specific claim depend on the circumstances and the parties involved. Holding your own crypto in a hardware wallet does not automatically give you a right to compensation after theft.

Questions to ask before trusting your wallet

• Do I know for certain where my hardware wallet was purchased?
• Have I ever entered my recovery phrase digitally or shared it with someone?
• Do I keep my recovery phrase offline and out of other people's reach?
• Do I check the full receiving address on the screen before confirming a transaction?
• Do I know what to do if my device may have been tampered with?

If your Ledger was not purchased through CryptoBilis, the currently confirmed information does not indicate that your device was affected by this specific attack. Still, review your security practices and use only official software and support.

If you bought a device through CryptoBilis, follow Ledger's official guidance. If you have lost funds, contact Ledger Support and report the incident to local law enforcement. Preserve the device as potential evidence and seek guidance before opening or sending it away.

A hardware wallet can be a useful security tool, but its safety also depends on where it came from and how you protect your recovery phrase. This article is for educational purposes only and does not constitute financial advice.

Sources

• Ledger, official website and security information
• Ledger Support, official support and incident reporting
• Ledger Donjon, official security research team
• European supervisory authorities, warning on crypto assets and limited consumer protection, October 6, 2025
• US Securities and Exchange Commission, report containing bitcoin price data for the first half of 2026
• BleepingComputer, reporting on the hidden chip in Ledger wallets, October 2026