Ledger confirmed that a hidden chip inside CryptoBilis branded devices secretly transmitted users' wallet master keys over a mobile network. Hardware wallets are sold as the safest way to store crypto offline, so a hidden transmitter undermines the core promise buyers pay for.
What actually happened
On 13 October 2026, Ledger gave its first public account of how a covert component found in devices sold by CryptoBilis could steal users' master keys, according to CoinDesk. Ledger said the chip transmitted wallet keys over a mobile network. The company said the compromise did not require any change to Ledger's own software. CryptoBilis sold the affected devices. The report reviewed for this article does not specify how many devices were affected, when the chip was discovered, or how many users lost funds.
How we got here
Hardware wallets like Ledger's devices are built to keep private keys offline, isolated from internet-connected computers and phones. That design is the main reason buyers choose them over software wallets. Supply-chain tampering, where a third party alters hardware after manufacture, has long worried security researchers across the industry. CryptoBilis is named in Ledger's account as the seller of the compromised devices, not as Ledger itself. The case marks one of the first public instances where a third-party seller, rather than the original manufacturer, is linked to a hidden transmitting component inside wallet hardware.
Why this matters for you
For holders, this is a reminder to verify the seller and packaging of any hardware wallet before trusting it with funds. Buying directly from Ledger or its verified retailers reduces exposure to altered devices. For builders, the incident adds pressure to develop tamper detection and open hardware verification tools. For the wider market, it may push exchanges and wallet apps to warn users about unofficial resellers. Trust in hardware wallets rests on the physical device matching its advertised design. Any break in that chain can expose funds regardless of software security.
The bigger question
If a hidden chip can steal wallet keys without changing a wallet's own software, how much security can any offline hardware device truly guarantee? Can buyers ever verify that the physical device they hold matches its advertised design, without opening and testing every single unit themselves, and who should bear that cost? This question extends beyond crypto, to any device that claims to protect sensitive data offline.
What to watch
Watch for Ledger's promised technical follow-up detailing how the chip operated and which device models were affected. Watch also for any statement from CryptoBilis addressing the claims. Further reporting may reveal the scale of affected units and whether authorities get involved. No official remediation timeline has been announced. Bonuz will track developments as hardware wallet security remains central to how people safely hold crypto assets.
