SecurityHeroblog
Security Basics2views

The Half-Price Coin Wallet Had Carbon Paper Under the Recovery Words

A Ledger hardware wallet sold at nearly half the list price was reported to contain a chip the manufacturer never made. According to researchers' analysis, that chip sent out the 24 recovery words that appear during initial setup. Here's why where you bought your device is itself a security question, and what to do right now.

Picture a handwritten shipping label. You press the address firmly onto the top sheet. The same writing appears on the sheet below. That happens because there is carbon paper in between. Carbon paper is a thin copy sheet that transfers the marks pressed from above straight onto the paper below.

For a shipping label, that is convenient. But if someone secretly slipped carbon paper under the notebook where you write down your passwords, it’s a different story. You write as you always do. And an identical copy of that writing appears on the sheet below. That lower sheet doesn’t stay in your hands — it goes to someone else.

This week’s coin wallet news is exactly that kind of story.

First, what’s the scene here

Two terms first.

A hardware wallet is a device that keeps the key you need to withdraw your coins on a small gadget separate from the internet. The device named in this case is a product from a company called Ledger.

Recovery words are the 24 English words that appear on screen one by one when you first turn this device on. Even if you lose the device, you can restore the wallet as long as you have these words. Turned around, that means anyone with just these words can move the entire wallet without the device. That’s why everyone writes them on paper and tucks it deep in a drawer.

FACT Here is what the victim in this case experienced. They bought a hardware wallet at nearly half the list price. They turned it on for the first time and wrote down the 24 words that appeared on screen. They pressed the buttons to confirm them too. A few days later they opened the wallet app and the balance was zero.

FACT Ledger was reported to have stated on October 10 that it found an unauthorized chip in at least one affected user’s device. That means a part Ledger did not make was inside the device. On October 11, it was reported to have stated that all confirmed cases involved devices sold by a Southeast Asian reseller called CryptoBilis.

FACT There’s one thing to point out here. CryptoBilis was reported to be a company Ledger had listed as an official reseller for Indonesia, Malaysia, and the Philippines. A reseller is a shop that takes a manufacturer’s product and sells it on their behalf.

INFERRED So summing this up as “they bought from a shady unofficial shop and got burned” would be wrong. This happened with devices sold by a shop on the list. That’s why this case is hard to brush off.

How the carbon paper got there

FACT According to reporting citing researchers’ analysis, the added chip learned the recovery words by reading the device’s screen output and button input. It then sent those words outside via eSIM and LTE communication.

Let me unpack two unfamiliar terms. An eSIM is the SIM card you insert into a phone, built directly into a chip instead. LTE is the mobile network phones use. Put the two together and the chip can contact the outside world on its own, with no Wi-Fi and no computer connection.

INFERRED In carbon paper terms, it’s like this. Normally, someone has to come and take the lower sheet in person. With this carbon paper, the lower sheet walked itself to the mailbox. By the time you closed the notebook and put it in the drawer, it was already too late.

FACT Researchers were reported to have confirmed two ways the chip was inserted.

  • Replacing the original battery with a smaller one and placing the chip in the freed-up space
  • Leaving the original battery in place and putting the chip where the cushioning material under the screen sits

Cushioning material is the soft stuff that props up parts so they don’t knock against each other. From the outside, neither one looks any different from the original device.

FACT There’s a more troubling point. Ledger has a genuineness check feature that verifies whether a device is authentic. But according to Ledger’s support documentation, it was reported that this feature cannot catch the added chip as long as the original secure chip is still in place. The secure chip is the core part that protects the key inside the device.

INFERRED In notebook terms, the genuineness check is about looking at whether the brand on the cover is real. The cover is indeed real. It just doesn’t flip through to the carbon paper slipped between the pages. That’s why it’s hard to notice anything wrong while you’re using it.

FACT Ledger was reported to have said that its own systems and direct sales channels were not breached. CryptoBilis was reported to have halted hardware wallet sales until the investigation concludes.

The scale in numbers

For each number, I’ve written down what you should compare it against. Read the right-hand column first.

Number What it counts How to read it
24 Number of recovery words About one dictation exercise’s worth. This short list is the key to the entire wallet
Nearly half the list price What the tampered devices sold for (researchers’ claim) Read it as a warning sign, not a half-price discount
90 days The purchase window Ledger set for “check your device if you bought from CryptoBilis during this period” About three months. However, Bitquery considered that purchases since June may also be affected
$86–93 million The scale of theft estimated by outside researchers This is not an official loss figure confirmed by Ledger

FACT That last number is an estimate from outside researchers who traced blockchain records. Blockchain records are a ledger where all the transfers of coins are public to everyone. Ledger has not confirmed this amount.

INFERRED So this number should not be read as a “confirmed loss figure.” Read it only this way: many people had put all of their assets on a single device. They did so because they believed it was a safe. This number is not a victim count either. How many victims there are is written separately in the “What We Don’t Know” section below.

What I should do right now

FACT Based on Ledger’s recommendations and the brief, I’ve narrowed it to three things.

1. Start by checking where you bought it. If you have a hardware wallet you bought from CryptoBilis, or from anywhere other than the manufacturer’s official store, do not set it up yet. Ledger was reported to have recommended not setting up any device bought from this reseller within the last 90 days.

2. If you’re already using one, move to a new notebook. Get a new device purchased directly from the manufacturer. Generate new recovery words there and move your assets.

INFERRED You have to assume that anything written in a notebook with carbon paper under it has already been copied. Erasing in the same notebook leaves the lower sheet untouched. So changing only the device isn’t enough — you have to generate new words too.

3. Cut off any contact claiming to be “Ledger customer support” and asking for your words.

FACT Ledger stated that it does not initiate contact by phone or DM (direct message), and does not ask for recovery words. It was reported to have also warned about impersonation scams using this incident as bait.

FACT There aren’t many clues you could notice while using the device. What the brief listed is about this much.

  • Did you buy it unusually cheaply compared to the list price
  • Did you buy it on an open marketplace, auction, or secondhand rather than the official store
  • Are there signs it has already been used even though you never set it up

Researchers say you can see an antenna wire if you open the device. But taking a device apart isn’t something an ordinary user should do. Checking the three items above is enough.

FACT Let me note the applicable scope too. The confirmed victims are CryptoBilis buyers. Among the researchers’ samples, there were reportedly also devices bought from Amazon Japan (Chinese seller, shipped from Malaysia) and Yahoo Auctions Japan.

INFERRED So domestic coin investors who bought a hardware wallet overseas or on an open marketplace below the list price may want to run through the checklist above as well. That said, there has been no reporting that domestically distributed stock was contaminated.

Carbon paper is invisible to the person writing. That’s why, with a notebook, where you got it comes first. The same goes for a hardware wallet.

What We Don’t Know

The following has not yet been confirmed. This post does not pretend to know these parts.

  • When, where, and by whom the devices were swapped. Ledger said it does not know yet either.
  • The number of affected wallets and victims. CoinDesk reported more than 300 based on researcher estimates. The Block said the exact number is not yet known.
  • The official loss figure. The $86–93 million is an outside estimate and Ledger has not confirmed it.
  • Whether CryptoBilis was involved in the tampering. Ledger has not named this reseller as the tamperer. Changpeng Zhao claimed that “attackers acquired the reseller,” but no evidence was produced.
  • The claim on X (formerly Twitter) that European MediaMarkt stock was also contaminated. This is unconfirmed and Ledger has not mentioned it.
  • Whether tampered devices exist in distribution channels other than CryptoBilis. It was reported that there are no indications so far.
  • Whether there is domestically distributed stock or any domestic victims. There is no reporting on this.
  • The attacker. Not identified. We do not speculate about nationality or affiliation.
  • The provenance of the chip design. The eSIM/LTE approach and the two installation forms are secondhand information from BleepingComputer citing Tibane Labs and Mark Karpelès.

Sources

Primary sources

Reporting

Brief reference date 2026-10-13. This post is not from our honeypot observations — it is press reporting restated in our own words. We were not able to open Ledger’s official X post or the original Tibane Labs report ourselves. So we wrote this by cross-checking what four outlets cited against each other. The attacker, the timing and route of the tampering, the official loss figure, and the victim count have not been confirmed. This case has no IPs to mask or credentials to quote, so we did not cover those. We also did not write down malicious addresses or installation methods.