BULLSTAR 
For years, the advice has been simple: keep your crypto on a hardware wallet. This week, that advice got a lot more complicated. Ledger has confirmed that at least one of its devices, sold through a reseller in Southeast Asia, contained a hidden implant built to steal recovery phrases. Then buyers in Europe reported finding similar modifications in Ledger wallets bought at MediaMarkt, one of the continent's biggest electronics chains.
Here's what has been confirmed so far, what is still only reported, and exactly what to do if you own a Ledger or plan to buy a hardware wallet.
A hidden chip inside some tampered Ledger devices reads your 24-word recovery phrase from the screen during setup and sends it out over a mobile network. The thief can then empty the wallet whenever they want. Ledger says its own systems and direct sales were not affected. If you bought from a third-party seller, don't set up an unused device, and if you already use one, move your funds to a new wallet with a brand-new recovery phrase.
What Happened: The Timeline
| Date (2026) | What happened |
|---|---|
| October 9 | Reports of drained wallets in Southeast Asia. Ledger asks reseller CryptoBilis to pause sales and shipments. |
| October 10 | Ledger confirms an unauthorized hardware implant inside one affected user's device sold through CryptoBilis. |
| October 12 | A buyer in Europe posts a video of a second Ledger Nano X from a different MediaMarkt store with extra cables and a cellular (LTE) module, and calls for a recall. Trezor removes CryptoBilis from its reseller list. |
| October 13 | Ledger's security team (Donjon) publishes a technical update. MediaMarktSaturn removes Ledger devices from its stores and website. Trezor announces it will cut its reseller network. |
Sources for the timeline include reports by Cointelegraph, The Crypto Times and Cryptopolitan. The story is still developing, so details may change.
How the Implant Works
According to Ledger's security team, the implant is a small extra circuit hidden inside the device's case. It doesn't hack the secure chip that protects your keys. Instead, it does something much simpler: it reads the screen.
When you set up a new hardware wallet, the device shows you your 24-word recovery phrase so you can write it down. The implant captures those words as they appear and sends them out through a built-in mobile (LTE) connection. Anyone who has those 24 words can recreate your wallet on another device and move your funds, without ever touching your Ledger.
That's why the attack is so dangerous. The wallet works normally, transactions look normal, and Ledger says the implant doesn't change the device's software or signatures. You only find out when the funds are gone.
What Is Confirmed and What Isn't
A lot of claims are circulating online. Here's where things stand:
| Status as of October 13, 2026 | |
|---|---|
| Implant in a CryptoBilis-sold device | ✓ Confirmed by Ledger |
| How it works | Reads the 24-word recovery phrase from the screen during setup and sends it out over a mobile (LTE) connection, per Ledger Donjon |
| Secure Element or Ledger software changed | ✗ No, according to Ledger. The implant is a separate component |
| Devices from MediaMarkt in Europe | ~ Reported by buyers, not yet confirmed by Ledger. Devices sent to Ledger for analysis |
| Total losses | ~ Not confirmed by Ledger. On-chain researchers estimate more than $72M to $86M |
| Devices bought directly from Ledger | ✓ No reports so far, according to Ledger |
The European reports come from a buyer who says he bought two Ledger Nano X devices at two different MediaMarkt stores and found the same added cables and cellular module in both. He says store records trace the stock to a distributor called Aqipa, and he has sent the devices to Ledger for analysis. Ledger hadn't publicly confirmed those devices when we published this, but MediaMarktSaturn pulled Ledger products from its stores while the investigation continues.
What to Do If You Own a Ledger
- Check where you bought it. If it came directly from Ledger's website or official store, there have been no reported cases with those devices so far.
- If you bought from CryptoBilis or another third-party seller and haven't set it up yet: don't set it up. Contact the seller and Ledger Support.
- If it's already set up and holds funds: buy a new device from an official channel, create a brand-new recovery phrase on it, and move your funds there. Don't just restore your old 24 words onto the new device, because those words may already be compromised.
- Never type your recovery phrase into a website, app or form, and never share it with anyone claiming to be support. Ledger says it will never call or message you, or ask for your recovery phrase.
- If you lost funds, contact Ledger Support so your case is included in the investigation, and file a police report.
Big security news always brings fake "recall" emails, fake support accounts and fake "wallet check" websites. Ignore any message that asks for your recovery phrase or tells you to "verify" your wallet through a link. Only use addresses you type yourself, like ledger.com.
How to Buy a Hardware Wallet Safely
This incident doesn't mean hardware wallets are unsafe. It means where you buy matters as much as which brand you buy. Before you set up any hardware wallet, run through this checklist:
Note that Ledger's Genuine Check verifies the security chip, but the reported implant is a separate component inside the case, so a tampered device could still pass. It's a useful step, not a guarantee. The safest move is to buy only from the manufacturer's official store.
Other brands are reacting too. Trezor said it has no evidence its devices were compromised, but it removed CryptoBilis from its list and announced it will cut its reseller network, with affected reseller authorizations ending on January 1, 2027 (source).
What This Means for Traders
If you trade with signals, most of your trading capital probably sits on an exchange, and only your long-term holdings live on a hardware wallet. That split still makes sense. Keep only what you actively trade on an exchange, and keep the rest in self-custody on a device you bought from an official store and set up yourself.
Security is part of risk management. A perfect trade plan with a stop loss on every signal means nothing if someone can empty your wallet. Our 5 risk management rules cover the trading side, and our guide on how to spot a fake crypto signals channel covers another common way traders lose money.
We post important market and security news, plus signals with a stop loss on every trade, in our free Telegram channel.
Join Bullstar Signals free channelFrequently Asked Questions
What happened with Ledger devices in October 2026?
Ledger confirmed that at least one hardware wallet sold through CryptoBilis, a reseller in Southeast Asia, contained an unauthorized hardware implant. According to Ledger, it reads the recovery phrase from the screen during setup and sends it out over a mobile connection. Buyers in Europe have since reported similar modifications in devices bought at MediaMarkt, which Ledger has not yet confirmed.
Is my Ledger safe?
If you bought it directly from Ledger and generated your recovery phrase yourself during setup, there have been no reported cases involving those devices so far. If you bought it from a third-party reseller, especially CryptoBilis or a store involved in the reports, follow Ledger's guidance: don't set up an unused device, and move funds from an already used one to a new wallet with a newly generated recovery phrase.
Did MediaMarkt stop selling Ledger wallets?
Yes. On October 13, 2026, MediaMarktSaturn said it had removed Ledger products from its shelves and website while it works with Ledger on the investigation.
Does Ledger Genuine Check detect the implant?
Not necessarily. Genuine Check verifies the device's security chip and software, but the reported implant is a separate component inside the case, so a tampered device could still pass. Buying from official channels matters more.
How much money was stolen?
Ledger has not confirmed a total. On-chain researchers have estimated losses of more than $72 million to over $86 million across Bitcoin, Ethereum and Tron, linked to the CryptoBilis case.
Should I stop using hardware wallets?
No. A hardware wallet bought from the official manufacturer is still one of the safest ways to hold crypto. The lesson is where you buy it: only from the official store, and always generate a new recovery phrase yourself.
Final Thoughts
The Ledger implant case is a reminder that self-custody is only as safe as the device you set it up on. The secure chip wasn't broken. The attack worked because tampered devices reached buyers through the supply chain and captured the recovery phrase during setup. Buy only from official stores, always generate a new recovery phrase yourself, and treat any message asking for your 24 words as a scam.
This article is based on public reports and statements up to October 13, 2026. The investigation is ongoing and details may change. This is not financial or security advice for your specific situation. If you think your device is affected, contact Ledger Support directly through ledger.com.