Ledger details LTE-enabled spy implants in wallets sold by CryptoBilis

Details

Ledger detailed how LTE-enabled implants exposed wallet recovery phrases as CryptoBilis halted sales and Trezor and OneKey cut ties with the reseller.

Malicious implants in Ledger wallets sold by CryptoBilis captured users’ recovery phrases from device screens and transmitted them over cellular networks, the French hardware wallet maker said.

Ledger Donjon, the company’s security research team, found that the implants used a microcontroller to decode the 24-word phrases displayed during setup and transmitted the data over LTE networks using an embedded SIM (eSIM), according to a Tuesday X post by Ledger.

The implants did not compromise the devices’ security chips or alter transactions, Ledger said.

The incident surfaced Friday after crypto losses were reported involving Ledger devices sold through CryptoBilis , a reseller listed as authorized in Indonesia, Malaysia and the Philippines.

Ledger confirmed Saturday that one affected device contained an unauthorized implant . Blockchain investigator Specter said losses could exceed $86 million, while cybersecurity outlet Yfarmx raised its own estimate to $103 million. Ledger hasn’t confirmed the total.

Ledger says it has sold more than 8 million hardware wallets, devices that keep users’ private keys offline and let them approve transactions on-device.

Ledger urged users who suspect tampering to contact its support team and file a police report.

Ledger directed concerned customers who bought devices elsewhere to an inspection guide , which warns that opening a device could damage it and advises users to back up their recovery phrases first.

Although confirmed losses have so far involved devices sold by CryptoBilis, Ledger said it is examining reports beyond the reseller.

Separately, X user Johannes posted photos of two Ledger devices he said he bought from separate stores of MediaMarkt, a European consumer electronics chain. He said he found implants in both devices. Ledger has not confirmed whether the European reports are linked to the CryptoBilis incident.

CryptoBilis halts all wallet sales as Trezor, OneKey cut ties

CryptoBilis said in an X post on Saturday that it had suspended sales and shipments of all hardware wallet brands across Malaysia, the Philippines and Indonesia, expanding an earlier halt limited to Ledger devices.

The reseller also temporarily closed its physical stores and said it was reviewing its processes with independent specialists.

Related: Ledger implant tests Bitcoin ETFs as safer custodial solutions than hardware wallets

Trezor said Monday that it had received no reports of tampered Trezor devices sold through CryptoBilis and found no indication that its products were affected. It nevertheless removed CryptoBilis from its authorized reseller network.

OneKey reported no related user losses as well, but terminated CryptoBilis’ reseller authorization. It also suspended onboarding new resellers and began reviewing its existing distribution network. The company offered free replacements for OneKey devices purchased from CryptoBilis between March 1 and Oct. 12, 2026, with customers able to apply through Dec. 31.

Magazine: France is world’s most dangerous place for Bitcoiners: 90 attacks in 7 months

Subscribe to daily byte-sized crypto news from Cointelegraph

Trezor reduces resellers as a ‘preventative step’ amid Ledger tampering reports

Digital cash offers ‘cash-like privacy,’ but bank data breaches threaten users: BIS

Trezor reduces resellers as a ‘preventative step’ amid Ledger tampering reports

Digital cash offers ‘cash-like privacy,’ but bank data breaches threaten users: BIS

MediaMarktSaturn pulls Ledger products amid tampering reports

Bitcoin hits $84K resistance as Korean tech rout deepens KOSPI losses

France is world’s most dangerous place for Bitcoiners: 90 attacks in 7 months

Blur is shutting down its website, so why are NFT collectors cheering?

Binance to shut down crypto mining pool services in November

Cointelegraph is committed to providing independent, high-quality journalism across the crypto, blockchain, AI, and fintech industries.

All news, reviews, and analyses are produced with full journalistic independence and integrity. For more details on our standards and processes, please read our Editorial Policy .

Related Coins

SOL

Source

Cointelegraph RSS