Hidden Chip in CryptoBilis Wallets Stole Ledger Keys

Ledger says a secret chip built into CryptoBilis branded hardware wallets quietly sent users' master keys out over a mobile network. If your coins ever sat in one of these devices, your keys may have already left your pocket without you noticing.

What actually happened

On 13 October 2026, Ledger issued its first public statement on the discovery, according to CoinDesk. The company said a concealed chip inside devices sold under the CryptoBilis brand transmitted wallet master keys over a mobile network. Ledger stressed that no change to its own software caused the leak. CryptoBilis, not Ledger, sold the affected units. The reviewed report does not state how many devices were sold, when the chip was found, or how many users lost funds. Ledger has not named specific device models yet.

How we got here

Hardware wallets exist to keep private keys offline, away from phones and computers connected to the internet. That isolation is the entire reason people pay extra for them instead of a software wallet or exchange account. Security researchers have warned for years about supply chain tampering, where someone alters hardware after it leaves the factory. This case differs because the tampering is tied to a third party seller, CryptoBilis, rather than Ledger itself. It is one of the first public cases of a reseller, not a manufacturer, linked to a hidden transmitting part inside wallet hardware.

Why this matters for you

For everyday holders, the lesson is simple. Buy hardware wallets only from the manufacturer or a verified retailer, never from an unknown reseller or marketplace listing. Inside the bonuz ecosystem, where wallets connect to everyday spending and rewards, this is a reminder that the weakest point is often the physical device, not the app. Builders across the industry may now face pressure to add tamper evidence seals or open verification tools. Exchanges and wallet apps could start warning users more directly about unofficial sellers. Software security means little if the hardware was quietly altered before it reached your hands.

The bigger question

If a hidden chip can leak wallet keys without touching the wallet's own software, how much protection can any offline device honestly promise? Can an everyday buyer ever confirm their device matches its advertised design without opening it themselves, and who should be responsible for that check?

What to watch

Watch for Ledger's promised technical breakdown of how the chip worked and which models were hit. Watch too for any response from CryptoBilis. No fix or recall timeline has been set. Further reporting could reveal how many devices and users were affected. Bonuz will keep following this story as it shapes how people verify hardware wallets.