Ledger reveals LTE-enabled spy implants in wallets sold by CryptoBilis stealing users' recovery phrases
Ledger, a French hardware wallet maker, detected malicious implants inside wallets sold by the reseller CryptoBilis that intercepted users' 24-word recovery phrases displayed on device screens and transmitted them via LTE cellular networks using embedded SIMs. Ledger affirmed that device security chips remained uncompromised and transactions were unaltered. The revelations follow reports of crypto theft linked to these devices, with estimated losses potentially exceeding $86 million. Ledger is continuing its investigation as the incident unfolds.
Discovery of malicious implants in Ledger wallets
Ledger’s security research team Donjon found that the implants incorporate a microcontroller that decodes the 24-word recovery phrases displayed during device setup. The captured data is then transmitted over LTE cellular networks via an embedded SIM card (eSIM). Ledger confirmed that device security chips were not compromised and that transaction integrity remained intact.
Incident background and estimated losses
The incident came to light on Friday following reports of cryptocurrency theft involving Ledger wallets sold through CryptoBilis, a reseller authorized in Indonesia, Malaysia, and the Philippines. On Saturday, Ledger confirmed one affected device contained an unauthorized implant. Blockchain investigator Specter estimated losses upwards of $86 million, while cybersecurity outlet Yfarmx reported a higher projection of $103 million. Ledger has yet to confirm the total amount.
Ledger’s response and user guidance
Ledger urged any customers suspecting tampering to contact customer support immediately and file a police report. The company also released an inspection guide for devices purchased elsewhere, cautioning users that opening wallets may cause damage and recommending backing up recovery phrases beforehand.
Ongoing investigations and European reports
While confirmed thefts so far involve devices purchased via CryptoBilis, Ledger is investigating reports beyond this reseller. A user named Johannes on X posted images of two Ledger units bought from different MediaMarkt stores in Europe, claiming both contained implants. Ledger has yet to comment on whether these cases are related to the CryptoBilis breach.
CryptoBilis halts sales amid growing concerns
CryptoBilis announced on Saturday a suspension of sales and shipments of all hardware wallet brands across Malaysia, the Philippines, and Indonesia, expanding an earlier halt limited to Ledger devices. The reseller also temporarily closed its physical stores and stated it is reviewing its operational procedures with independent experts.
Trezor and OneKey sever ties with CryptoBilis
Trezor reported no instances of tampered devices sold via CryptoBilis and found no evidence its products were affected; however, it removed CryptoBilis from its authorized reseller list. OneKey similarly reported no user losses alleged but terminated CryptoBilis’ reseller authorization, suspended onboarding new resellers, and began auditing its distribution network. OneKey is offering free replacement devices to customers who purchased from CryptoBilis between March 1 and October 12, 2026, with applications accepted until the end of December.
Why it matters
This news is significant because it highlights vulnerabilities in hardware cryptocurrency wallets, long considered among the most secure methods for storing crypto assets. The discovery of implants capable of intercepting recovery phrases via LTE networks demonstrates the advanced tactics employed by attackers to compromise private data while bypassing embedded security chips. The multi-million dollar losses emphasize the critical need for thorough supply chain scrutiny, especially in regions with less stringent digital oversight. The responses from manufacturers, resellers, and the wider community underscore the importance of transparency and prompt action in addressing security threats within the crypto industry.
Prepared from the source material with AI-assisted editing and checked against the supplied facts.
Open original source ↗