- Published on
Ledger details LTE-enabled spy implants in wallets sold by CryptoBilis
- Authors
- Name
- DeepHorus
Ledger, the French hardware wallet maker, said malicious implants in devices sold by reseller CryptoBilis captured users' recovery phrases from device screens and transmitted them over LTE cellular networks. Ledger Donjon, its security research team, found the implants used a microcontroller to decode the 24-word phrases displayed during setup, relaying them through an embedded SIM. The implants did not compromise the devices' security chips or alter transactions, Ledger said.
The scheme surfaced Friday after crypto losses were reported involving Ledger devices sold through CryptoBilis, a reseller listed as authorized in Indonesia, Malaysia and the Philippines. Ledger confirmed Saturday that one affected device contained an unauthorized implant. Blockchain investigator Specter said losses could exceed $86 million, while cybersecurity outlet Yfarmx raised its estimate to $103 million. Ledger has not confirmed the total.
Ledger says it has sold more than 8 million hardware wallets, devices that keep private keys offline. The company urged users who suspect tampering to contact support and file a police report. It also pointed customers to an inspection guide warning that opening a device could damage it, advising them to back up recovery phrases first. Ledger said it is examining reports beyond CryptoBilis.
X user Johannes separately posted photos of two Ledger devices he said he bought from different MediaMarkt stores in Europe, claiming both contained implants. Ledger has not confirmed whether those reports are linked to the CryptoBilis case.
CryptoBilis said Saturday it suspended sales and shipments of all hardware wallet brands across Malaysia, the Philippines and Indonesia, expanding an earlier halt limited to Ledger devices. The reseller also temporarily closed its physical stores and said independent specialists were reviewing its processes.
Trezor said Monday it found no sign its products were affected but removed CryptoBilis from its authorized reseller network. OneKey reported no related losses and terminated the authorization, offering free replacements for devices bought between March 1 and Oct. 12, 2026.
