Ledger's Donjon Reveals How the Hidden Implants Read Recovery Phrases and Phoned Them Home Over LTE

Published October 13, 2026, 8:40 PM PKT. Based on the October 13, 2026 update from Ledger's Donjon security team on X, the company's October 9 and October 10 investigation statements, and reporting by Cointelegraph, crypto.news, The Crypto Times, tsnmedia, and shattered.io.

Ledger now knows exactly how the spy hardware inside the tampered wallets worked. In an update published October 13, 2026, the company's in-house security research team, Ledger Donjon, said the unauthorized implant sat inside the device's enclosure and read the information shown on the device's screen. During setup, a Ledger device displays the 24-word recovery phrase, the master key to everything in the wallet. The implant's microcontroller decoded the words when those screens appeared and transmitted them over LTE using a provisioned eSIM, according to the company.

The finding answers the central question that has hung over the CryptoBilis incident since Ledger confirmed the implant on October 10: how a device whose private keys are locked inside a Secure Element chip could still be drained. The answer, according to Donjon, is that the attacker never needed to defeat the cryptography. The implant operated as a separate component, reading the screen like a camera and sending what it saw out over a mobile data connection, no internet connection or computer required.

A microcontroller watching the screen

The implant's job was narrow and patient. It sat dormant inside the casing and waited for the setup flow, the one moment when the wallet's most sensitive secret is visible in plain text. When it detected the recovery-phrase screens, its microcontroller decoded the words and pushed them out over LTE through its own embedded SIM card, Ledger Donjon said in the October 13 update, which Ledger posted on X.

That design explains why standard security checks never caught it. Genuine firmware verification checks the operating system and the Secure Element, both of which the implant never touched. Ledger said the component does not modify the Secure Element, the Ledger operating system, transactions, or signatures. A tampered device looked, acted, and signed exactly like a genuine one, right up until the attacker's copy of the seed phrase was used to drain the wallet from anywhere in the world.

The tampering had to happen physically, before the device reached the buyer. Ledger has previously described the implant as unauthorized hardware found inside the enclosure, which points to interference during manufacturing or distribution rather than a flaw in Ledger's own software.

The still-unknown total

Ledger has not confirmed how many people were affected or how much was lost. The figures circulating online all come from third-party trackers, and Ledger said it has not verified them. Blockchain investigator Specter put suspected losses above $86 million across hundreds of wallets on Bitcoin, Ethereum, and TRON. Crypto outlet Yfarmx raised its own estimate to $103 million. Bitquery's trace put the total at $92.9 million across 311 wallets, according to reporting by shattered.io.

What Ledger has confirmed is the boundary of the damage so far: all confirmed fund losses tied to the incident disclosed on October 9 involve signers sold through CryptoBilis, the Southeast Asian reseller listed as an authorized Ledger distributor for Indonesia, Malaysia, and the Philippines. "We have not verified a drain linked to a signer bought elsewhere," the company said in its October 13 update, though it added that its researchers are reviewing reports of implants in other signers and locations.

The Europe question

The reports from other locations now include Europe. An X user named Johannes posted photos of two Ledger devices he said he bought from separate stores of MediaMarkt, the European consumer electronics chain, and said he found implants in both, according to Cointelegraph. Ledger has not confirmed whether the European reports are linked to the CryptoBilis incident.

Europe has already figured in the fallout. PeckShield traced $3.89 million of the suspected theft funds to Binance deposits, a trail that reached the European side of the exchange's footprint. OneKey, a rival hardware wallet maker, has already dropped CryptoBilis from its distributor program and offered free replacements to affected buyers. The reseller itself halted all hardware wallet sales and shipments on October 9 at Ledger's request.

If the MediaMarkt devices are confirmed as tampered, the incident stops being a story about one bad reseller and becomes a broader supply-chain problem for hardware wallets. Ledger's own statement leaves that door open by saying it is reviewing reports beyond CryptoBilis.

What holders should do now

Ledger's advice has not changed, and it is blunt. Buyers who got a device from CryptoBilis but have not set it up should not set it up and should contact Ledger Support. Buyers who already set one up should transfer their assets promptly to a new device with a new recovery phrase. The company urged anyone who suspects tampering to contact its support team and file a police report.

For customers who bought elsewhere, Ledger pointed to an inspection guide, which warns that opening a device could damage it and advises users to back up their recovery phrases before any inspection. The company also repeated that it has no indication its own security infrastructure, systems, or services have been compromised.

Until the investigation closes, the practical rule is the one that has applied since October 9: if the device came from CryptoBilis, treat the seed phrase as already compromised and move.

This article is news reporting and is not investment advice.

Sources

• Ledger / Ledger Donjon (@Ledger, @DonjonLedger on X), update on the CryptoBilis investigation (Oct. 13, 2026), primary source for the implant's mechanism (screen reading, microcontroller decoding, LTE/eSIM exfiltration), the Secure Element being unmodified, confirmed losses limited to CryptoBilis-sold signers, and the review of implant reports beyond the reseller
• Ledger Support (@Ledger_Support on X), investigation statements (Oct. 9 and Oct. 10, 2026), primary source for the sales halt ordered to CryptoBilis and the confirmation that an affected user's device contained an unauthorized hardware implant
• Cointelegraph, Ledger Says LTE Implants Copied CryptoBilis Wallet Recovery Phrases (Oct. 13, 2026), secondary source for the Donjon findings, the 8-million-wallets context, and the MediaMarkt Europe reports
• crypto.news, Ledger reveals how hidden chips stole wallet recovery keys (Oct. 13, 2026), secondary source for the eSIM/LTE exfiltration details and the "no verified drain elsewhere" statement
• The Crypto Times, Ledger Explains CryptoBilis Hack as Questions Over Tampered Wallets in Europe, Asia Persist (Oct. 13, 2026), secondary source for the tampered-wallet questions across regions
• tsnmedia.org, Ledger Confirms Hardware Implant in One CryptoBilis Device (Oct. 13, 2026), secondary source for Ledger's advice to CryptoBilis buyers and the unverified loss totals
• shattered.io, Ledger CryptoBilis Hack: $92.9M Drained, 311 Wallets (Oct. 10, 2026), secondary source for the Bitquery loss trace across TRON, Bitcoin, Ethereum, BNB Chain, and Polygon, and CryptoBilis's October 9 sales halt