Science & Tech · Cybersecurity · 1 hr ago
Tampered Ledger wallets reportedly sent recovery phrases to thieves
Ledger makes the Nano X, a hardware wallet used to manage cryptocurrency.
The devices are meant to keep users’ recovery phrases, which can unlock their funds, secure and offline.
Investigators say tampered wallets added a chip that read the phrase from the device’s screen and an LTE connection that sent it to thieves.
The Secure Element chip inside the wallet was reportedly not altered.
Blockchain observers say they have identified more than 300 affected wallets, with losses estimated at about $93 million.
Ledger has acknowledged one customer’s loss and advised people who bought from the suspected seller Cryptobilis in the past three months not to use the devices and to move funds elsewhere.
Ledger has also stopped Cryptobilis from making further sales and told its retailers not to resell returned devices.
Tampered Ledger Nano X hardware wallets reportedly captured users’ recovery phrases and sent them to thieves over mobile networks.
Blockchain observers say more than 300 wallets have been affected, with losses totaling about US$93 million.
The attackers allegedly added components that read the wallet screen and transmit the phrases using an LTE modem and eSIM.
Ledger acknowledged that one customer suffered a financial loss and had a manipulated wallet, but has not confirmed the full scale or exact method.
Ledger advised customers who bought from Cryptobilis in the previous three months not to use the devices and to move any remaining funds.
- Who
- Unidentified attackers allegedly tampered with Ledger Nano X wallets. Blockchain observers report more than 300 affected wallets.
- What
- Modified devices reportedly captured recovery phrases and sent them to thieves, leading to cryptocurrency losses.
- When
- The report was published on 13 October 2026. Ledger’s warning applies to purchases from Cryptobilis in the previous three months.
- Where
- The devices were reportedly sold by Cryptobilis, a wallet retailer operating mainly in Southeast Asia from Malaysia. One reported device was bought through Amazon Japan and posted from Malaysia.
- Why
- The attackers allegedly sought access to cryptocurrency holdings secured by the captured recovery phrases.
This story does not have two clearly opposing sides.
Embedded specialist Joe Grand presented apparently hand-modified Ledger Nano X devices at the Hardware.io conference.
Unverified screenshots reportedly indicated that Cryptobilis had a new owner.
Heise reported the alleged wallet tampering and Ledger’s advice to customers who had bought from Cryptobilis in the previous three months.
- Affected wallets
- More than 300, according to blockchain observers
- Reported losses
- About US$93 million
- Wallet model
- Ledger Nano X
- Alleged transmission method
- LTE modem, eSIM module and antenna
- Retailer named in report
- Cryptobilis, operating mainly in Southeast Asia from Malaysia
- Publication date
- 13 October 2026
What people are saying
The Ledger Nano X is the most secure way to manage your cryptocurrency
Sources
Related news
Cyberattack Defrosts Refrigerators at Hundreds of French Supermarkets
Cyberattack heats fridges at hundreds of French supermarkets
Cyberattack disrupts cooling systems at hundreds of French supermarkets
Canadian cybersecurity executive arrested on federal extortion charges
Attackers target critical SonicWall SMA 1000 flaw days after disclosure
Tokyo to strengthen cybersecurity and increase digital staff
Gartner urges Japanese companies to make digital security a top priority
Survey finds human error remains a leading cybersecurity concern
Singapore to use available AI models in new cybersecurity strategy
Cyberattack damages refrigeration systems at hundreds of French supermarkets
Canadian cybersecurity executive arrested in FBI ShinyHunters investigation
