Ledger wallets were drained this month by an implant inside the case. Not a bug, and not a breach of Ledger’s own systems — a small board that watched the screen and posted what it read over the mobile network.

The case for a hardware wallet is simple: your seed never touches the computer. You write 24 words on steel, the keys stay inside a secure element, and a compromised laptop cannot reach them.

This month that story met a hole it does not cover. The seed does not have to touch your computer. It touches the screen.

What happened

On 9 October, people who had bought Ledger signers from CryptoBilis, a reseller in South East Asia, found their balances gone. Bitquery, the on-chain analysis firm, followed every drained wallet across six chains and puts the total at $102.0M taken from 324 wallets — TRON, Bitcoin, Ethereum, Solana, BNB Chain and Polygon. The pattern it describes is not opportunistic. The drain ran for 47 minutes. 25 TRON wallets signed the same approval within 3 seconds of each other, and roughly $29M moved within 6 seconds of the first. The same operator had run test loops two weeks earlier. As of 13 October, Bitquery could still find about $84M sitting on-chain.

Ledger’s response is public and dated. On 9 October it asked CryptoBilis to pause all sales and shipments, and told anyone who had bought from that reseller in the previous 90 days: if you have not set the device up yet, do not; if you have, consider moving your assets to a new signer with a new seed. On 10 October it confirmed that one affected user’s device contained an unauthorised hardware implant. On 11 October it said the volume of impacted devices is limited, that all confirmed cases involve devices sold through CryptoBilis, and that its own direct sales channels are unaffected. On 13 October, after a customer in Germany reported an implant, MediaMarkt Saturn stopped selling Ledger devices, with Ledger’s agreement and no funds reported lost in that case, and Ledger asked resellers in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales while the investigation continues.

Ledger also says, repeatedly, that many claims and figures circulating online are unverified, and that it has not confirmed a total value lost. So this post quotes Ledger when it is Ledger speaking, and attributes the numbers to the firm that published them.

What the implant actually is

Two descriptions exist now, and they agree. Ledger’s own security team, Donjon, published this on 13 October:

The implant sits inside the enclosure and reads the data shown on the screen. During setup, the signer displays the 24-word recovery phrase. When the implant detects these screens, its microcontroller decodes the words and transmits them over LTE using a provisioned eSIM. The implant is a separate component. It does not modify the Secure Element or the Ledger operating system, and it does not alter transactions or signatures.

Sit with that last sentence. Nothing is broken. The device is not behaving oddly, because its behaviour was never tampered with. The display bus is simply being watched.

The reverse-engineering detail comes from Joe Grand, who tore down an implanted Nano X after the same class of device was reported in August 2025, and presented the work at hardwear.io in 2026. In his slides: the OLED talks to the secure element over SPI, and the implant monitors that bus. Its firmware holds glyphs for a-z at 0x4D00-0x4E40 and template-matches them against the screen traffic. When it recognises the recovery phrase being displayed, it writes the words to flash at 0x7000 and sends them out through a Luat Air700E cellular module on an 8 cm hand-wound coil antenna at roughly 937 MHz. The microcontroller is a 3 x 3 mm Cortex-M0+ with its markings scrubbed off. To keep the device looking normal, the thermistor was swapped for a fixed resistor and the fuel gauge bypassed so the battery always reads 100 per cent.

No keys leave the chip. The words are read off the glass, then posted over a mobile network that has nothing to do with your computer.

Why “it passed the check” means less than you think

The attestation everyone relies on verifies a chip. Ledger’s own guidance, from its own site, is worth quoting exactly:

It cannot detect unauthorized physical modifications to the hardware — such as spying implants — if the original Secure Element remains intact.

That is the structural problem, and it follows directly from the mechanism. The secure element was never touched, so an attestation of the secure element is silent about the case, the flex cable, or the extra board sitting between the screen and the chip. Grand’s remediation advice amounts to the same conclusion: check hardware integrity against known-good pictures, and buy direct from the vendor or an authorised reseller.

What is not established

I am not going to imply more than the sources support. Five things are genuinely open:

• The total is a moving figure. $102.0M from 324 wallets is Bitquery’s live count, and it says it keeps updating. Ledger has not verified any total, and other circulating numbers are lower or differently scoped.
• “One seller” describes confirmed losses, not all implants. Ledger’s wording is that the funds drained are limited to devices sold through CryptoBilis and that it has not verified a drain linked to a signer bought elsewhere. Grand’s specimen came from an online seller in Thailand, and other researchers have reported implants in devices from other channels.
• The German retail case rests on one customer’s public report. Ledger acknowledged the report, says no funds were lost, and has not confirmed the device, the store or the pathway.
• The timing theory is speculation. A widely repeated claim that a public disclosure in early October triggered the 9 October drain is unconfirmed — Bitquery’s timeline shows the operator running test transactions two weeks before, already holding the keys.
• Frozen is not returned. Tether froze $10.0M across 20 wallets and Circle can freeze a further $2.38M. None of that has been returned to victims, and freezes elsewhere have failed before.

If you own one of these devices

Ranked by what actually removes the risk:

1. If your recovery phrase was ever displayed on that screen during setup, treat it as leaked. Not probably fine — leaked. Generate a new seed on a device whose provenance you trust and move the funds. Changing the PIN achieves nothing here; a new seed is the only fix.
2. If you bought from a marketplace, an auction site, an off-brand listing, or a reseller you cannot name, have the device opened and compared against known-good internal pictures — Grand’s slides include the reference views. Opening a sealed device has consequences, from the warranty to the risk of damaging it, so have someone qualified do it. This is still the only check that examines the part of the device the attestation ignores.
3. When buying, prefer direct from the vendor or an in-person authorised retailer over any marketplace listing, sealed or not. Packaging proves very little.
4. Do not let one device hold what you cannot afford to lose. Multiple signatures across devices from different vendors means a single compromised device cannot move funds on its own. That is the structural answer to a supply-chain attack, and it is the reason multisig exists.
5. Expect the second wave. Ledger states it will never call you, message you directly, or ask for your 24-word recovery phrase. The implant takes a seed silently; the phishing that follows an incident like this asks you for one. Both ends of this story are about the same 24 words.

The lesson worth keeping

A hardware wallet moved trust off the exchange and onto a device you hold. That was real progress, and it is still progress. But the trust boundary was never the chip alone — it is the chip, the case around it, the bus to the screen, and the seller who handed it to you. The secure element did its job perfectly. It was bypassed, not broken.

I have not torn a device down for this post and I will not pretend otherwise. This is what the primary sources say: Ledger’s own statements and documentation, and an independent teardown with published slides. If you were hoping for the reassuring version, the reassurance is that the defence is cheap and dull — buy from someone you can hold accountable, open the case when provenance is doubtful, and treat any phrase that has ever appeared on a device of unknown history as already gone.