What Is Ledger?
Ledger was founded in France in 2014 and has focused on one thing ever since: developing hardware wallets for cryptocurrencies. According to the company, it has sold more than 7 million devices, which are used in 180 countries worldwide.
The reason behind its popularity is straightforward. Private keys are stored in a dedicated secure chip rather than on a computer or smartphone that remains connected to the internet. This helps reduce the risk of compromise when interacting with potentially vulnerable devices.
Features and Benefits of Ledger Wallets
Ledger wallets are equipped with a Secure Element chip designed to protect private keys and perform cryptographic operations. Transactions are signed directly on the device, and private keys should never be transferred to a connected computer or smartphone.
Another useful feature is the ability to verify the recipient's address on the wallet's own screen before confirming a transaction. This helps reduce the risk of funds being sent to a substituted address as a result of malware on a computer.
However, a hardware wallet cannot protect against every threat. Much depends on whether the device is genuine and how the recovery phrase is stored.
Compromised Wallets
In October 2026, the manufacturer reported a concerning discovery. Hardware wallets sold by CryptoBilis in Southeast Asia had reportedly been modified at the hardware level. An additional electronic module capable of capturing images from the screen was found in one of the inspected devices.
The attack reportedly worked as follows. During the initial setup, the wallet displays a 24-word recovery phrase. The hidden module recognized the phrase and transmitted it to malicious actors over an LTE mobile network using a built-in eSIM. With access to this phrase, an attacker could restore the wallet on another device and gain control over its funds, potentially draining the entire balance.
According to the manufacturer, all confirmed cases of fund theft reported to date were linked to devices supplied by CryptoBilis. The company has not yet disclosed how many users were affected or the total value of the stolen funds.
Another particularly concerning detail is that the module reportedly did not interfere with either the Secure Element chip or the wallet's operating system. As a result, standard authenticity checks might not have detected the hardware modification.
How to Avoid Becoming a Victim of a Spy Module in Your Wallet
Start with the most important precaution: purchase hardware wallets directly from the manufacturer or through trusted, officially authorized resellers. Verify a seller's authorization through official sources rather than relying solely on claims made on its website.
Once you receive the device, carefully inspect both the packaging and the wallet itself. Signs of tampering, unfamiliar components, additional wires, or other indications that the device may have been disassembled and reassembled should raise concerns. If you suspect tampering, do not use the device, enter your recovery phrase, or transfer funds to it.
Always generate the recovery phrase yourself during the wallet's initial setup. If you have purchased a replacement device, make sure it comes from a reliable source and that its new recovery phrase is generated independently.
Before confirming each transaction, verify the recipient's address directly on the device's screen. Store your recovery phrase separately from the wallet. Never send it through messaging apps, save it in cloud-based notes, or share it with anyone.
If you purchased a wallet through CryptoBilis, the manufacturer advises against setting it up. If you are already using such a device, transfer your assets to a new, verified genuine wallet and generate a new recovery phrase as soon as possible.
If you have reason to believe your funds have already been stolen, do not attempt to open or modify the device yourself. Contact the manufacturer's official support team and the relevant law enforcement authorities, preserving any available records of the purchase, the device, and suspicious transactions.
