Bought a Ledger From a Reseller? Why Genuine Check Passes on the Spy-Chip Devices, and the 5 Checks That Actually Rule It Out (2026)

Here is the sentence that changes how you should think about any hardware wallet bought outside the maker’s own store: the attackers did not break Ledger’s chip. They bought real devices, opened them, added their own hardware, and sent them back into the retail chain.

Ledger said that in its October 15, 2026 response, and it matters because every software check you were taught to run assumes the hardware is the hardware it left the factory as.

Not investment or security advice. Details come from Ledger’s public statements and security-press reporting as of October 16, 2026, and the investigation is still open. If you think your device is affected, follow Ledger’s official support channel, not a message that contacts you first.

What This Covers

• What did Ledger actually confirm?
• Who is affected, and who is probably not?
• Why doesn’t Genuine Check catch it?
• Five Checks, in the Order That Rules Things Out
• What do I do if I already set the device up?
• What is changing at resellers?
• Tips
• Warnings
• FAQ
• Sources

What did Ledger actually confirm?

Ledger confirmed on October 13, 2026 that a covert implant inside the enclosure of some signers sold by CryptoBilis read the 24-word recovery phrase from the device screen during setup and transmitted it over LTE using a pre-provisioned eSIM, while leaving the Secure Element, the operating system, transactions and signatures unchanged (CoinDesk, October 13, 2026).

The timeline is short:

1. October 9. Ledger opens an investigation into reported fund drains and asks CryptoBilis to stop selling and shipping Ledger devices.
2. October 10. Ledger confirms that at least one affected user’s device contained “an unauthorized hardware implant.”
3. October 13. Ledger’s Donjon security lab publishes how the implant works and asks resellers across Southeast Asia and Hong Kong to suspend sales.
4. October 15. Ledger’s formal response: “There was no flaw in Ledger’s chip, operating system or servers.” Attackers “bought genuine Ledger devices, opened them, fitted custom-built hidden components” and put them “back into distribution through resellers in South East Asia” (Ledger, October 15, 2026).

Independent researchers who opened affected units described a small microcontroller, an eSIM, a shielded LTE module and, in one variant, a smaller replacement battery to make room, with a second variant tucked into the foam under the screen (BleepingComputer, October 12, 2026). The giveaway in both was an antenna wire.

How much was stolen is not settled. On-chain researchers cited by CoinDesk put it at up to $93.2 million across more than 300 wallets, and Tether froze $10 million in USDT linked to the thefts. Ledger has not confirmed a total and has asked people not to speculate.

Who is affected, and who is probably not?

Every loss Ledger has confirmed so far involves a device sold by CryptoBilis, a Malaysia-based reseller operating across Southeast Asia, and Ledger says it has not verified a theft from a signer bought anywhere else.

“Probably not” is doing work in that heading, so here is the honest range:

• Confirmed: devices sold by CryptoBilis. Reporting says tampered units were sold at nearly half the normal price, which is its own warning sign.
• Under review: Ledger says it is “also reviewing reports of implants in other signers and locations.” A German MediaMarkt Saturn customer reported a suspected implant, and the retailer stopped selling Ledger devices while that is checked.
• Clean so far: Ledger says its teams spot-bought devices in local markets, including Germany, and examined warehouse samples, and that “every unit examined was clean.”
• Not involved: devices bought directly from Ledger. Ledger says its own systems and direct sales channels were not compromised.

The model named in the security-press reporting is the Nano X. One researcher claimed a separate implant in a Flex bought at Singapore Airport; Ledger has not confirmed that one.

Why doesn’t Genuine Check catch it?

Ledger’s Genuine Check cannot detect an added implant when the device’s original Secure Element is intact, because the check verifies that the secure chip and firmware are authentic, not that nothing else was added inside the case (Ledger support guidance quoted by BleepingComputer, October 2026).

That is the whole trick. The implant never talks to the secure chip. It watches the screen. During setup the device has to show you the 24 words, and anything that can see the display at that moment can copy them.

So a green Genuine Check on a tampered device is expected, not a false negative. Ledger’s own wording in press reports is that a successful Genuine Check “alone cannot rule out the implant described in this investigation.”

Five Checks, in the Order That Rules Things Out

When I compared Ledger’s statements with the researchers’ teardown notes, I found that the checks fall into a clear order, from “decides it immediately” to “only suggestive.” Work down the list and stop when you have an answer.

Order and weighting are our reading of Ledger’s statements (October 9–15, 2026) and the teardown details reported by BleepingComputer. Ledger’s own hardware-integrity guidance is linked in Sources.

Most people run check 5 first, because it is the one with a button. Run check 1 first. It takes ten seconds and it is the only one Ledger has tied to confirmed losses.

What do I do if I already set the device up?

If a Ledger device bought from CryptoBilis has already been set up, Ledger’s advice is to transfer the assets promptly to a new signer with a newly generated recovery phrase, because the existing phrase should be treated as known to the attacker.

Three details people get wrong in the rush:

• Do not restore the old phrase onto the new device. Ledger has warned that moving an exposed recovery phrase to different hardware does not remove the attacker’s access. The phrase is the key, not the plastic.
• Generate the new phrase on hardware you trust the origin of. Buying the replacement from the same reseller defeats the point. Ledger’s own store, or a device you can verify came from an authorised channel, is the safer source.
• Move everything, including tokens on chains you forgot about. The attacker has the whole phrase, which means every account derived from it on every network.

If you bought from CryptoBilis and have not set the device up, Ledger’s instruction is simpler: do not initialise it, and contact Ledger Support.

And if you only bought from a different reseller and have no other red flags, Ledger’s position is that it has not verified any theft outside CryptoBilis. The reasonable middle path is to keep the phrase private, watch the address for movement, and consider generating a fresh phrase on a device of known origin if the balance is large. Our guide to protecting a wallet after the H1 2026 hacks covers address monitoring without handing anyone your keys.

What is changing at resellers?

Ledger’s October 15, 2026 statement sets new rules for its authorised resellers: returned devices can “never be resold in any form, even if they look new and unopened,” products are to be kept off shelves and displays and handed over at the time of purchase, and resellers must promptly report any customer report of an unusual product.

Ledger also says it has been working on “additional measures to thwart this kind of attack at the product level” and will share details later. That is the part to watch, because a reseller policy only helps at resellers that follow it.

Honestly, the cleaner takeaway for buyers is simpler than any policy: the cheaper the “sealed” hardware wallet on a marketplace, the more you should ask why.

Tips

• Buy signing devices from the manufacturer’s store or an authorised reseller, and keep the receipt. Provenance is now a security feature.
• Set up a new device with a small test balance first. A drained test wallet costs you little and tells you a lot.
• Write the 24 words with the device screen angled away from any camera, and never type them into a phone or computer.
• Bookmark Ledger’s official channels page and ignore any support contact you did not start yourself.

Warnings

• A passing Genuine Check does not rule out this implant. Ledger has said so directly.
• Never restore a possibly exposed recovery phrase onto a new wallet. Generate a new one.
• Expect phishing that references this incident. Ledger will not call you, DM you, or ask for your 24 words.
• Opening a device to look for an implant can break it. Move funds first if you plan to look.

FAQ

Can the implant steal my crypto if I never see the recovery phrase on screen again?

The attack reads the phrase during initial setup, when the device displays the 24 words. If a tampered device was set up even once, assume the phrase was captured at that moment, regardless of what you do afterward.

Is a Ledger bought from Amazon or another marketplace safe?

Ledger has only confirmed losses from CryptoBilis devices, but researchers reported buying a tampered unit through a marketplace seller shipping from Malaysia. Treat third-party marketplace sellers as resellers of unknown origin and apply the same checks.

Does this affect Trezor or other hardware wallets?

Ledger’s investigation covers its own devices. The method, adding hardware that watches the screen during setup, is not specific to one brand, so the same buying precautions apply to any signing device purchased outside the maker’s own channel.

Sources

• Ledger — Ledger’s Response to the Hardware Implant Attack (October 15, 2026)
• CoinDesk — Ledger finds covert cellular implant stole hardware wallet recovery phrases from screens (October 13, 2026)
• BleepingComputer — Ledger confirms hardware wallet spy implant behind crypto thefts (October 12, 2026)
• Ledger Support — Genuine Check

Fact-checked against Ledger’s October 13 and 15, 2026 statements and security-press teardown reporting as of October 16, 2026. The investigation is ongoing; this is not security or investment advice.