The Chip That Read Ledger’s Recovery Words

The moment a backup becomes visible

A hardware wallet has to show its owner a secret. During setup, the 24 recovery words appear on its small screen so they can be recorded. In Ledger’s October 13, 2026 account of the CryptoBilis investigation, an unauthorized component inside the case watched that same display. Its microcontroller decoded the words and sent them over LTE through a provisioned eSIM.^[1]

The backup feature explains the stakes. A recovery phrase is a human-readable route back to a wallet’s underlying keys, not merely a password for one physical device. BIP 39 also supports an optional additional passphrase, which affects the resulting wallet. Where the words provide the necessary recovery information, copying them can let someone reconstruct the keys elsewhere. The original device need not sign the later theft.^[6][1]

The transfers came before the explanation

On October 9, losses appeared on Bitcoin, TRON and Ethereum. Bitquery’s reconstruction places a concentrated wave of withdrawals that morning (UTC), followed by further drains. Its eventual investigation covers six chains, including BNB Chain, Polygon and Solana. The synchronized activity led its analysts to infer that an attacker already controlled many wallets’ keys. That is an interpretation of transaction records; those records alone cannot identify the physical route by which a secret escaped.^[2]

The physical evidence arrived on a separate timeline. Ledger says it confirmed an implant in one affected user’s device on October 10, then described the mechanism on October 13. In that update, the company tied all confirmed losses in the disclosed incident to devices sold through CryptoBilis. It did not confirm the total number of affected users or the value lost.^[1]

Reading around the protected chip

Ledger’s explanation places the added component beside the wallet’s normal security system. The company says it does not modify the Secure Element or Ledger operating system, and does not change transactions or signatures. Its target is information being displayed during setup. That makes the screen path central to this account of the attack.^[1]

Separate work by Tibane Labs makes that path tangible. Its field report examines two implanted Nano X specimens obtained through Japanese marketplaces. It describes extra circuitry tapping the SPI data lines between the Secure Element and OLED display: the traffic used to draw the words can be read and reconstructed. A cellular module provides the outgoing connection. This is interception inside the device, not a claim that researchers broke its cryptography.^[3]

Those specimens must stay separate from the CryptoBilis evidence. Tibane explicitly says it has not tested a CryptoBilis-sold device and has no evidence linking its specimen B to that reseller. Its report helps explain a screen-interception design; it does not establish the origin of every affected unit or prove that Nano X is the only affected model. A genuine security chip and an altered surrounding assembly can coexist.^[3][1]

Two estimates, no verified victim total

Pseudonymous investigator Specter’s October 9 post listed ten receiving addresses and estimated losses above $86 million, referring to hundreds of victim wallets on chains including Bitcoin, Ethereum and TRON. It did not establish a verified count of physical devices. A wallet count is not automatically a count of people or products.^[7]

Bitquery’s later investigation estimates $102 million from 324 wallets across six chains. It says its method counts assets leaving victim wallets, excluding subsequent swaps and transfers among the attacker’s wallets. Broader chain coverage and additional addresses help explain why its tally differs from the earlier one. The figure is Bitquery’s analytical estimate, not a sum to add to Specter’s.^[2]

Ledger’s October 13 statement leaves the number of users and total loss unverified. Nor does an on-chain tally prove that every included drain came from the same implant. Treating these estimates as the ends of one confirmed damage range would erase those differences in scope and evidence. The investigation has both a hardware finding and a financial estimate; they are not interchangeable measurements.^[1][2][7]

An authorized store is still a distribution channel

The precaution widened beyond one seller. In its update dated October 13, Ledger asked resellers and distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales and remove devices from shelves. A wider stop-sale request is a containment measure, not proof that every seller in those markets distributed tampered stock.^[5]

On October 15, Ledger’s own reseller directory showed sales temporarily paused for Malaysia’s Shopee Mall authorized store and the Philippines’ LazMall and Shopee Mall authorized stores. These are specific listed shops, not platform-wide bans by Shopee or Lazada. The same directory explains that an authorized store on a marketplace can be operated by a reseller rather than Ledger itself. The badge and the operator answer different questions.^[4]

Who altered the devices, and where along distribution it happened, remained questions in Ledger’s notice. The company said it had no indication that its infrastructure, systems, services or direct sales channel had been compromised. That is the company’s stated investigative position, not a guarantee that every directly purchased device has been individually cleared.^[5]

Why a replacement needs new words

Ledger’s published guidance tells CryptoBilis buyers not to initialize an unused device. Those who already initialized one are told to transfer assets promptly to a new device with a new recovery phrase, and not to enter or restore a phrase on a CryptoBilis device. For losses or suspected tampering, it directs users to official support and local law enforcement, with coordination before opening or sending the device. These instructions belong to the identified incident and should be checked against current official guidance.^[1]

The reason for new words follows from how recovery works. Restoring the same phrase on another device recreates the same keys; it does not take a copied secret away from someone who already has it. This incident puts that distinction in physical form. Protecting a key inside a chip matters, and so does the path by which its backup becomes visible to the owner. The remaining investigation has to connect that path to the devices sold, the people affected and the funds lost.^[6][1]