Ledger Discovered Hardware Implant in User’s Device amid Investigation into Theft

• Ledger discovered a hardware implant in a crypto wallet and urged some users not to activate their devices.
• CryptoBilis has halted sales of hardware wallets.
• In addition, scammers are impersonating Ledger on Google, and fake pages are stealing seed phrases.

Ledger, a hardware crypto wallet manufacturer, reported that it had detected an unauthorized hardware implant in one of the devices belonging to affected users. The company is continuing its investigation, working with law enforcement and the retailer CryptoBilis, which has temporarily stopped selling all hardware wallets. 

Ledger Announced Investigation amid Theft of over $86M from Users

10.10.2026

Read now

In parallel, researchers warned about a fake Ledger website and app in Google Search designed to steal recovery phrases.

Ledger Urged Users to Check Their Devices

In a message from Ledger Support, the company said that an unauthorized hardware implant was found in one of the affected users’ devices. Ledger is reaching out to users as part of the investigation and is working with the relevant authorities to hold the perpetrators accountable. Ledger also thanked the SEAL 911 team for its assistance.

At the same time, the company stressed that there are currently no signs of any compromise of its security systems, infrastructure, or services.

As a precaution, CryptoBilis has stopped selling all hardware wallets until the investigation is complete. Ledger remains in contact with the retailer regarding next steps.

The company recommended that users who purchased Ledger devices from this retailer but have not yet set them up should not begin the setup process. Those who have already activated their wallet are advised to consider moving their assets to a new device with a new seed phrase.

Ledger also urged users to watch out for scams that can accompany incidents like this, and reminded them that the company never asks for a 24-word recovery phrase. Information about the investigation can be submitted via the bug bounty program.

A Fake Ledger Site Was Found in Google Search

Cybersecurity researcher Cyber Scrilla reported a scam Ledger website and app that appear among the top Google Search results. 

According to him, the pages are designed to steal seed phrases, and Google showed more than 1 million visits over the previous 30 days. At the same time, the researcher emphasized that there is no confirmed link between this resource and the alleged $86 million theft.

Earlier, specialists at Zscaler ThreatLabz described a phishing campaign that used fraudulent Google ads to target Ledger owners. The ads redirected users via Google Cloud Storage and Vercel to a fake Google Sites page that mimicked the Ledger interface. The bogus device verification process required users to enter their secret recovery phrase, after which the data was sent to an attacker-controlled server.

According to the researchers’ observations, Vercel redirect domains changed roughly every 15–20 minutes, making the campaign harder to detect.

Against the backdrop of these incidents, it is also worth mentioning a vulnerability that the OneKey Anzen team reported in late August. At the time, OneKey founder and CEO Yishi Wang said researchers had managed to reproduce an attack that allowed a transaction to be swapped during signing in the Ethereum app for Ledger version 1.22.1. In such a scenario, the user could see one transaction, but actually sign another.

Сообщение Ledger Discovered Hardware Implant in User’s Device amid Investigation into Theft появились сначала на INCRYPTED.