The Check That Passed
In October 2026, the hardware wallet industry learned something uncomfortable: a device can pass its manufacturer’s authenticity check and still steal your recovery phrase.
Here’s what is known so far, from Ledger’s statements and reporting by The Block, BleepingComputer, Decrypt and Cointelegraph:
- Around 9 October, customers in Southeast Asia began reporting drained wallets. All confirmed cases traced back to devices sold by CryptoBilis, a Malaysia-based reseller.
- On 13 October, Ledger’s security team confirmed that those devices contained unauthorised LTE implants: a small extra circuit board hidden inside, with its own eSIM and cellular modem.
- The implant captured the 24-word recovery phrase while it was displayed during setup and sent it to the attackers over the mobile network.
- It didn’t modify the secure element or the operating system, and it didn’t alter transactions. That’s why researchers found tampered devices passed Ledger’s Genuine Check — a limit Ledger itself acknowledged.
- On-chain researchers estimated suspected losses at between about $72 million and more than $90 million. Ledger says it hasn’t verified those figures. It says its own systems and direct sales channels were not compromised.
The story reached Europe the same week. On 13 October, MediaMarktSaturn suspended Ledger sales in its stores and online after a customer in Germany reported an implant in a unit. Ledger’s update said no funds were lost in that case. Other claims about devices bought in Europe were unverified at the time of writing.
The response spread across the industry. CryptoBilis suspended hardware wallet sales. Trezor said it had found no evidence its devices were compromised, but removed CryptoBilis from its seller list and announced it would cut back its reseller network from 1 January 2027. OneKey revoked CryptoBilis’s authorisation and offered replacements for devices bought through it between 1 March and 13 October 2026.
Three Ways a Hardware Wallet Can Be Fake
1. Counterfeit
The whole device is a copy. In 2023, Kaspersky analysed a counterfeit Trezor bought from a seller the victim trusted: its chip had been swapped, and it generated recovery phrases the attackers already knew. In April 2026, a counterfeit Ledger Nano S Plus sold on an online marketplace at the official price contained a hidden antenna and pointed buyers to a malicious app with a fake Genuine Check.
2. Tampered genuine device
A real device with something added — the October 2026 implants are the clearest example. In 2021, attackers mailed modified Ledger devices to customers whose addresses had leaked in a data breach.
3. Pre-initialised device
The device arrives already set up, or with a “recovery phrase card” already filled in. Whoever wrote those words owns the wallet. A genuine hardware wallet never comes with a recovery phrase. You generate it yourself, on the device, during setup.
What the Built-in Checks Prove — and What They Don’t
Ledger’s Genuine Check
The Ledger Wallet app (formerly Ledger Live) asks the device’s secure element to prove it was made by Ledger and is running genuine software. It’s good at catching counterfeit chips and modified firmware.
What it can’t see: extra hardware that leaves the secure element and operating system untouched. That’s exactly how the October implants worked.
Trezor’s authentication check
On Trezor Safe models, each device gets a unique certificate at manufacture. During setup, Trezor Suite sends the device a random challenge; the device signs it, and Suite verifies both the signature and the certificate. The Safe 7 uses two secure elements for this, including Trezor’s auditable TROPIC01 chip. Trezor strongly advises against turning the check off.
Trezor Suite also verifies that the firmware is genuine. But Trezor has been clear that an implant which doesn’t modify firmware works differently from what those checks are designed to catch.
The honest summary
Authenticity checks prove that the chips and software you’re talking to are genuine. They can’t prove that nothing else was added to the device. That’s why where you buy matters more than ever.
No vendor is immune. In March 2025, Ledger’s own security team showed that some older Trezor Safe 3 units could be reprogrammed through a physical supply-chain attack on their microcontroller. Trezor called the attack largely theoretical and fixed what it could. In October 2026, it was Ledger devices that were tampered with. The weakness is the supply chain, not one brand.
The Buying Rules After October 2026
- Buy directly from the manufacturer’s own store, reached by typing the address. Every reseller, marketplace seller or retailer adds a link to the chain of custody. Trezor’s advice after the incident was to buy directly and check that the packaging seal is intact. Ledger · Trezor
- Never buy used, opened or “returned” devices, or “new” ones at a suspicious discount. Tampered units were reportedly sold at close to half the price of genuine hardware.
- Inspect the packaging before opening. Look for broken seals, re-glued edges, or anything that doesn’t match the manufacturer’s unboxing guide.
- The device must arrive blank. No PIN set, no recovery phrase card filled in, no instructions to scan a QR code or “restore” a wallet.
- Install software only from the manufacturer’s website — not by searching an app store.
- Run the authenticity check during setup, and never skip it. It doesn’t catch everything, but it catches a lot.
- For larger holdings, don’t rely on one device. Trezor’s advice: a multisig wallet using devices from different manufacturers, so a single compromised device can’t move funds on its own.
Signs Something Is Wrong
- The recovery phrase is already printed or written anywhere in the box
- The device turns on already set up, or asks you to “restore” a wallet straight away
- Instructions tell you to visit a website other than the manufacturer’s, or to scan a QR code
- The box seal is missing, broken or looks re-applied
- A “new” device was sold well below the official price
Some implants leave no visible sign at all. Researchers say the only reliable way to find one is to open the device, which can damage it. Trezor specifically warns against forcing the casing open, especially on models with built-in batteries such as the Safe 7.
If You Bought From an Affected or Unknown Seller
- If you haven’t set it up yet: don’t. That was Ledger’s advice to anyone who bought from CryptoBilis in the past 90 days. Contact the manufacturer’s support through its official website.
- If you’ve already set it up: buy a new device directly from the manufacturer, create a new recovery phrase on it, and move your funds there. Don’t reuse the old phrase. A firmware update can’t remove a hardware implant.
- If you’ve already lost funds: Ledger advises coordinating with law enforcement before you open the device, since it may be evidence. Related: Your Crypto Was Just Stolen: What to Do in the First 24 Hours
- Expect fake “replacement” offers. Ledger warned that scammers would pose as Ledger after the news. Replacements and refunds are handled only through official support, which you contact yourself. Related: Fake Ledger and Trezor Support: How Hardware Wallet Owners Get Targeted in 2026
Frequently Asked Questions
My Ledger passed the Genuine Check. Is it safe?
The check confirms that the secure element and software are genuine. It can’t detect added hardware that leaves them untouched. If you bought directly from Ledger, the risk is very low. If you bought from a reseller or marketplace, especially at a discount, consider moving to a device bought directly.
Should I avoid MediaMarkt and other retailers?
After October 2026, buying directly from the manufacturer is the safest option, because it removes links from the chain of custody. That isn’t an accusation against any retailer. MediaMarktSaturn suspended Ledger sales itself while the issue was investigated.
Is Trezor affected?
As of mid-October 2026, Trezor said it had no evidence that its devices were compromised, while tightening its reseller network as a precaution. The buying rules above apply to every brand.
Can a reset or firmware update remove an implant?
No. An implant is extra hardware, and resetting or updating doesn’t touch it. A device you don’t trust should be replaced, not reset.
I bought a used device and reset it. Is that enough?
No. Tampering can survive a reset and may be invisible. Replace it with a new device bought directly from the manufacturer.
Transparency: TrueToCrypto may earn affiliate commissions from links in articles, including links to Ledger and Trezor. Recommendations are based on security merit, not commission rates. This article is educational and is not financial or security consulting advice.
Contact: info@truetocrypto.com
Sources: Ledger statements of 11 and 13 October 2026; The Block, BleepingComputer, Decrypt and Cointelegraph (9–13 October 2026); Help Net Security citing Bitquery; Trezor’s authentication-check documentation; Kaspersky (May 2023); The Block (13 March 2025) on the Trezor Safe 3 research. This is a developing story; check the manufacturers’ official channels for updates. Verified October 2026.
