# Is Ledger safe in 2026? Breaches, Recover, the CryptoBilis implants and what actually matters

Source: https://pausebeforesend.com/blog/is-ledger-safe/  
Published: 2026-10-25  
Last updated: 2026-10-25  
By: J  
AI-assisted, human-reviewed by J (2026-10-24).

**Short answer:** None of the Ledger incidents we verified involved a flaw in its chip or OS that let attackers pull keys from a device. The risks were leaked customer data, phishing, a hijacked code library, and, in October 2026, devices tampered with in resale that stole recovery phrases yet passed Ledger's Genuine Check. Buy direct. ([Ledger](https://pausebeforesend.com/blog/is-ledger-safe/#src-ledger-2026); [The Record](https://pausebeforesend.com/blog/is-ledger-safe/#src-record))

**What this covers:** is Ledger safe in 2026: a dated timeline of every Ledger incident we could verify against a primary source today (2020 data leak, 2023 Recover, 2023 Connect Kit, 2026 CryptoBilis implants), what Ledger's Genuine Check does and doesn't prove, and steps if you bought a Ledger from a non-official seller. **Who it's for:** you, if you own a Ledger Nano, Flex or Stax, or are about to buy one, and the tampered-device news has you wondering whether to keep using it. **What it isn't:** a product review, a ranking or investment advice; this page has no affiliate links, coin calls or exchange referrals.

## Key facts

- Ledger says thieves bought genuine devices, fitted hidden parts that capture the recovery phrase during setup, and put them back into distribution through resellers in Southeast Asia. It says there was "no flaw in Ledger's chip, operating system or servers." ([Ledger, Oct 15, 2026](https://pausebeforesend.com/blog/is-ledger-safe/#src-ledger-2026))
- Because the implant leaves the original Secure Element intact, tampered devices may still pass Ledger's authenticity check. ([The Record, Oct 13, 2026](https://pausebeforesend.com/blog/is-ledger-safe/#src-record); [Ledger Donjon](https://pausebeforesend.com/blog/is-ledger-safe/#src-donjon))
- Wallets were drained on Oct 9, 2026. Ledger has not confirmed total losses and says figures circulating online come from third parties. ([The Record](https://pausebeforesend.com/blog/is-ledger-safe/#src-record))
- Ledger says all confirmed fund losses involve devices sold by Malaysia-based reseller CryptoBilis; users also reported modified devices from other sellers in Asia and Europe. ([BleepingComputer, Oct 14, 2026](https://pausebeforesend.com/blog/is-ledger-safe/#src-bc-halt))
- Earlier incidents hit Ledger's customer database (2020) and a JavaScript library used by crypto web apps (2023), not the devices' key storage. ([Ledger, 2020](https://pausebeforesend.com/blog/is-ledger-safe/#src-ledger-2020); [Ledger, 2023](https://pausebeforesend.com/blog/is-ledger-safe/#src-ledger-ck))

## What has gone wrong at Ledger, and when?

Dates are as reported in each source (all opened 2026-10-25). We list only incidents we could verify with a source we opened today; see the [method note](https://pausebeforesend.com/blog/is-ledger-safe/#method).

| Date | What happened | What was exposed or lost | Source |
| --- | --- | --- | --- |
| 2020-06-25 | An unauthorized third party used an API key to access Ledger's e-commerce and marketing database. A bug-bounty researcher reported the hole on 2020-07-14; Ledger fixed it and disclosed on 2020-07-29. | About 1 million email addresses; Ledger said 9,500 customers also had name, postal address, phone number or products exposed. No payment data or crypto. | [Ledger](https://pausebeforesend.com/blog/is-ledger-safe/#src-ledger-2020) |
| 2020-12-20 | The stolen database was posted free on a hacker forum. Ledger's CEO said the dump showed a larger set than its July logs had found, and that Ledger would not refund customers. | 1,075,382 newsletter emails and 272,853 buyer records with names, mailing addresses and phone numbers (BleepingComputer's count; Ledger said about 272,000). Followed by phishing emails, texts and letters. | [BleepingComputer](https://pausebeforesend.com/blog/is-ledger-safe/#src-bc-2020); [Ledger](https://pausebeforesend.com/blog/is-ledger-safe/#src-ledger-ceo-2020) |
| 2021-05 | A user got an unsolicited "replacement" Ledger in the mail with a fake letter; it hid a flash drive with malware, and the user typed in their 24 words. | About $78,000 drained within 30 minutes, per Ledger. | [Ledger Academy](https://pausebeforesend.com/blog/is-ledger-safe/#src-ledger-buy) |
| 2023-05 (week of May 16) → 2023-05-23 | Ledger announced Recover, an opt-in, ID-verified service that stores encrypted backups of your seed with three custodians. After backlash, the CEO delayed it until its code was open-sourced. | Nothing lost. The controversy: critics said it contradicted the promise that keys never leave the device, and raised custodian, KYC-leak and subpoena risks. | [CoinDesk](https://pausebeforesend.com/blog/is-ledger-safe/#src-coindesk-recover) |
| 2023-10-24 | Recover went live for Ledger Nano X as an optional, paid service, again drawing criticism. | Nothing lost; opt-in only. | [CoinDesk](https://pausebeforesend.com/blog/is-ledger-safe/#src-coindesk-recover2) |
| 2023-12-14 | Connect Kit attack: a phished former employee's npm access, never revoked, was used to publish malicious Ledger Connect Kit versions 1.1.5–1.1.7. Web apps that loaded it showed drainer transactions to users. | Ledger said "a low volume of users" signed draining transactions; the file was live about 5 hours, with active draining under 2 hours. Devices and Ledger infrastructure were not accessed. | [Ledger](https://pausebeforesend.com/blog/is-ledger-safe/#src-ledger-ck) |
| 2026-09-16 → | Researchers began posting photos of an implant inside Ledger devices sold at nearly half price. | — | [BleepingComputer](https://pausebeforesend.com/blog/is-ledger-safe/#src-bc-implant) |
| 2026-10-09 | Wallets were drained in one coordinated wave. Ledger opened an investigation and told CryptoBilis to stop selling and shipping Ledger devices. | Losses unconfirmed by Ledger; third-party estimates circulate. | [The Record](https://pausebeforesend.com/blog/is-ledger-safe/#src-record); [BleepingComputer](https://pausebeforesend.com/blog/is-ledger-safe/#src-bc-implant) |
| 2026-10-10 | Ledger confirmed "an unauthorized hardware implant" in one affected user's device. | — | [BleepingComputer](https://pausebeforesend.com/blog/is-ledger-safe/#src-bc-implant) |
| 2026-10-13 | Ledger's Donjon lab: the implant reads the 24 words off the screen during setup and sends them over LTE using an eSIM. It does not modify the Secure Element or Ledger OS, so integrity self-checks can't detect it. | Recovery phrases of affected buyers. | [The Record](https://pausebeforesend.com/blog/is-ledger-safe/#src-record); [BleepingComputer](https://pausebeforesend.com/blog/is-ledger-safe/#src-bc-halt) |
| 2026-10-14 | Ledger halted distributor sales in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong. MediaMarkt pulled Ledger devices in Europe after reports. Trezor said it would cut some resellers on 2027-01-01. | — | [BleepingComputer](https://pausebeforesend.com/blog/is-ledger-safe/#src-bc-halt) |
| 2026-10-15 | Ledger called it "a localized distribution attack," not a systemic supply-chain attack, and told resellers to keep stock off shelves and never resell returns. | Ledger said every unit it spot-bought and screened was clean. | [Ledger](https://pausebeforesend.com/blog/is-ledger-safe/#src-ledger-2026) |

**Method note:** we did not include incidents we couldn't open a primary or reputable source for on 2026-10-25. That's why this table doesn't cover the separate Shopify-employee data incident Ledger has mentioned for late 2020: its support FAQ didn't load for us. Loss totals for October 2026 are left out on purpose because Ledger hasn't verified them.

## What does "safe" mean for a Ledger?

Each incident hit a different layer. It helps to keep them apart:

- **Key storage on the device: no break shown in these incidents.** In 2020, 2023 and 2026, Ledger said its chip and OS were not the failure point, and none of the sources above report keys extracted from an untouched device. ([Ledger](https://pausebeforesend.com/blog/is-ledger-safe/#src-ledger-ceo-2020); [Ledger](https://pausebeforesend.com/blog/is-ledger-safe/#src-ledger-ck); [Ledger](https://pausebeforesend.com/blog/is-ledger-safe/#src-ledger-2026))
- **The path the device takes to you: the 2026 weak point.** The implant didn't need to break the chip; it read the words off the screen while you wrote them down. Where you buy now matters as much as the device. ([Ledger Donjon](https://pausebeforesend.com/blog/is-ledger-safe/#src-donjon))
- **Your 24 words: the target of nearly every attack.** The 2020 leak fed years of phishing emails, texts and letters that ask for them. Ledger says it never contacts you by text or phone, and you should never enter your 24 words anywhere but the device. ([Ledger](https://pausebeforesend.com/blog/is-ledger-safe/#src-ledger-phish))
- **What you sign: the 2023 weak point.** The Connect Kit attack worked by getting people to approve draining transactions in web apps. Ledger's fix list included pushing Clear Signing over blind signing. ([Ledger](https://pausebeforesend.com/blog/is-ledger-safe/#src-ledger-ck)) See [how wallet drainers use token approvals](https://pausebeforesend.com/blog/wallet-drainer-token-approvals/).
- **Recover: a choice, not a default.** Recover is opt-in and paid; if you don't subscribe, your phrase isn't sent to custodians. Whether to trust it is a judgment call about third parties and ID checks. ([CoinDesk](https://pausebeforesend.com/blog/is-ledger-safe/#src-coindesk-recover); [CoinDesk](https://pausebeforesend.com/blog/is-ledger-safe/#src-coindesk-recover2))

## Does Ledger's Genuine Check prove my device is safe?

No. It proves the Secure Element is a real Ledger chip, which beats counterfeit devices. It does not prove nobody opened the case and added something.

> "Note that a Genuine check cannot detect unauthorized physical modifications to the hardware, such as spying implants, if the original Secure Element remains intact."
> Ledger Donjon, [Genuineness: Threat Model](https://donjon.ledger.com/threat-model/device-genuineness/), accessed 2026-10-25

Run the check anyway, but only in the Ledger Wallet app (formerly Ledger Live) downloaded from Ledger's own site or the official app stores. Ledger says counterfeit devices often ship with modified apps that report "genuine" for fake hardware. ([Ledger Academy](https://pausebeforesend.com/blog/is-ledger-safe/#src-ledger-buy))

## What should I do if I bought my Ledger from a non-official seller?

1. **Check the seller.** Compare the store, or the Amazon "Sold by" name, with [Ledger's official reseller list](https://www.ledger.com/reseller). A "Ledger store" on a marketplace may be run by a reseller, so check the operator's name. ([Ledger](https://pausebeforesend.com/blog/is-ledger-safe/#src-ledger-resellers); [Ledger Academy](https://pausebeforesend.com/blog/is-ledger-safe/#src-ledger-buy))
2. **Not set up yet and from CryptoBilis? Don't set it up.** Contact Ledger Support. ([The Record](https://pausebeforesend.com/blog/is-ledger-safe/#src-record))
3. **Came with a PIN or a recovery phrase already filled in? Don't use it at all.** A real Ledger never comes pre-configured. ([Ledger Academy](https://pausebeforesend.com/blog/is-ledger-safe/#src-ledger-buy))
4. **Already set up and holding funds, from CryptoBilis?** Move your assets promptly to a new device with a new recovery phrase, and don't enter or restore any phrase on the CryptoBilis device. ([The Record](https://pausebeforesend.com/blog/is-ledger-safe/#src-record))
5. **Already set up, from another unlisted seller?** The safest option is the same: buy a new device from Ledger or a listed reseller, create a new phrase on it, and move funds. [Our recommendation. Ledger's move-your-funds advice was issued for CryptoBilis buyers.]
6. **Lost funds?** Contact Ledger and local police before you open or ship the device. ([The Record](https://pausebeforesend.com/blog/is-ledger-safe/#src-record)) Then file reports in order: [how to report a crypto scam](https://pausebeforesend.com/blog/how-to-report-crypto-scam/).
7. **Ignore "firmware update" or "Genuine Check" messages.** Since the implant news, fake update pages have been asking for recovery phrases: [fake Ledger firmware updates](https://pausebeforesend.com/scams/fake-ledger-firmware-update/). Ledger doesn't email firmware-update requests. ([Ledger](https://pausebeforesend.com/blog/is-ledger-safe/#src-ledger-phish))
8. **Anyone offering to "recover" drained funds for a fee is the second scam.** See [crypto recovery scams](https://pausebeforesend.com/blog/crypto-recovery-scams/).

Setting up a new device? Follow our [hardware wallet setup checklist](https://pausebeforesend.com/blog/hardware-wallet-setup-safety/).

## Frequently asked questions

### Is Ledger safe to use now, in 2026?

For a device bought from Ledger or a listed authorized reseller and set up by you, the October 2026 attack doesn't change Ledger's design: Ledger says its chip, OS and servers weren't compromised. The risk is in the resale channel, phishing for your 24 words, and what you approve on screen.

### Did the CryptoBilis implant pass Ledger's Genuine Check?

It could. Ledger says the Genuine Check can't detect added hardware implants when the original Secure Element is intact, and The Record reported that tampered devices may still pass the authenticity check.

### Was my Ledger hacked if I bought it from Ledger directly?

Ledger says all confirmed fund losses involve devices sold by CryptoBilis, its direct sales channel is safe, and units it spot-bought and screened were clean. Ledger is still reviewing reports of implants from other sellers.

### Does Ledger Recover mean Ledger can access my seed phrase?

Recover is an optional paid service that only applies if you subscribe. It stores encrypted backups with three custodians. If you never subscribe, nothing is sent. Whether to trust those custodians and ID checks is your call.

### Was the 2020 Ledger data leak a hack of the devices?

No. It exposed Ledger's e-commerce and marketing database: about 1 million emails, plus names, mailing addresses and phone numbers for about 272,000 buyers. It didn't touch devices or funds, but the data has been used for phishing ever since.

## What to do next

**Bought a Ledger from a third-party seller?** Check the seller against [Ledger's official reseller list](https://www.ledger.com/reseller) before you set it up. If it came pre-set or with a recovery sheet already filled in, do not use it. Passing the Genuine Check isn't proof it wasn't tampered with. Comparing devices? Our [hardware wallet guide](https://pausebeforesend.com/wallet-safety/) is the separate, labeled product page. Lost funds? [Report the crypto scam in this order](https://pausebeforesend.com/blog/how-to-report-crypto-scam/).

Get one crypto scam warning a week from Pause Before Send: [join the newsletter](https://pausebeforesend.com/newsletter/).

No affiliate links, exchange referrals or coin calls on this page, by policy. Ledger is named because the incidents and the advice come from its own statements and news reporting.

## Sources

1. Ledger, "Ledger's Response to the Hardware Implant Attack," 2026-10-15. [ledger.com](https://www.ledger.com/blog-response-hardware-implant-attack) (accessed 2026-10-25)
2. Alexander Martin, "Ledger says hardware implant in cryptocurrency wallets stole recovery phrases," The Record from Recorded Future News, 2026-10-13. [therecord.media](https://therecord.media/ledger-cryptocurrency-wallet-implant-theft) (accessed 2026-10-25)
3. Bill Toulas, "Ledger confirms spy chip implant behind wallet crypto thefts," BleepingComputer, 2026-10-12. [bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/) (accessed 2026-10-25)
4. Bill Toulas, "Ledger asks sellers across Asia to halt sales after supply-chain attack," BleepingComputer, 2026-10-14. [bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/ledger-asks-sellers-across-asia-to-halt-sales-after-supply-chain-attack/) (accessed 2026-10-25)
5. Ledger Donjon, "Genuineness: Threat Model" (undated). [donjon.ledger.com](https://donjon.ledger.com/threat-model/device-genuineness/) (accessed 2026-10-25)
6. Ledger Academy, "Best Practices To Securely Buy Your Ledger Signer," 2026-03-06, updated 2026-09-18. [ledger.com](https://www.ledger.com/academy/topics/ledgersolutions/best-practices-to-securely-buy-ledger-signer) (accessed 2026-10-25)
7. Ledger, "Find a Ledger Reseller around the world" (living page). [ledger.com/reseller](https://www.ledger.com/reseller) (accessed 2026-10-25)
8. Ledger, "Ongoing phishing campaigns" (living page). [ledger.com](https://www.ledger.com/phishing-campaigns-status) (accessed 2026-10-25)
9. Ledger, "Addressing the July 2020 e-commerce and marketing data breach," 2020-07-29. [ledger.com](https://www.ledger.com/addressing-the-july-2020-e-commerce-and-marketing-data-breach) (accessed 2026-10-25)
10. Lawrence Abrams, "Physical addresses of 270K Ledger owners leaked on hacker forum," BleepingComputer, 2020-12-21. [bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/physical-addresses-of-270k-ledger-owners-leaked-on-hacker-forum/) (accessed 2026-10-25)
11. Pascal Gauthier, "Message by Ledger's CEO: Update on the July data breach," Ledger, 2020-12-21. [ledger.com](https://www.ledger.com/message-ledgers-ceo-data-leak) (accessed 2026-10-25)
12. Anna Baydakova, "Crypto Wallet Provider Ledger Delays Key-Recovery Service After Uproar," CoinDesk, 2023-05-23. [coindesk.com](https://www.coindesk.com/business/2023/05/23/crypto-wallet-provider-ledger-postpones-release-of-key-recovery-service-after-public-criticism) (accessed 2026-10-25)
13. Jamie Crawley, "Crypto Wallet Maker Ledger Officially Rolls Out 'Recover,' Unleashing Fresh Round of Snark," CoinDesk, 2023-10-24. [coindesk.com](https://www.coindesk.com/tech/2023/10/24/crypto-wallet-maker-ledger-officially-rolls-out-recover-unleashing-fresh-round-of-snark) (accessed 2026-10-25)
14. Ledger, "Security Incident Report" (Ledger Connect Kit), 2023-12-20. [ledger.com](https://www.ledger.com/blog/security-incident-report) (accessed 2026-10-25)

## Changelog

- 2026-10-25: First published. Every timeline row checked against the linked source the same day.