Ledger Details LTE-Equipped Spy Implants in Wallets Sold by CryptoBilis

Ledger explained how LTE-equipped implants expose wallet recovery phrases after CryptoBilis halted sales and Trezor and OneKey cut ties with the vendor.

Ledger explained how LTE-enabled implants reveal wallet recovery phrases, as CryptoBilis stopped sales and Trezor and OneKey cut vendor ties.

Malicious implants in Ledger wallets sold by CryptoBilis capture users' recovery phrases from the device's screen and transmit them over cellular networks, the French hardware wallet maker said.

According to a Tuesday X post by Ledger, Ledger Donjon, the company's security research team, found that the implants use a microcontroller to decode 24-word phrases displayed during startup and transmit the data using an embedded SIM card (eSIM) over LTE networks.

Ledger said the implants did not compromise the devices' security chips or alter transactions.

The incident emerged on Friday after reports of cryptocurrency losses involving Ledger devices sold through CryptoBilis, an authorized dealer in Indonesia, Malaysia and the Philippines.

Ledger confirmed Saturday that one affected device contained an unauthorized implant. Blockchain researcher Specter said losses could exceed $86 million, while cybersecurity outlet Yfarmx raised its estimate to $103 million. The ledger has not confirmed the total.

Ledger says it has sold more than 8 million hardware wallets, devices that store users' private keys offline and allow them to confirm transactions on the device.

Ledger urged users who suspect tampering to contact its support team and file a police report.

Ledger directed concerned customers who bought the devices elsewhere to an inspection guide, warning that opening the device could damage it and advising users to back up their recovery passwords first.

Although confirmed losses so far have involved devices sold by CryptoBilis, Ledger said it is investigating reports beyond the vendor.

Separately, user X, Johannes, posted photos of two Ledger devices he said he bought at separate stores of MediaMarkt, a European consumer electronics chain. He said he found implants in both devices. Ledger has not confirmed whether the European reports are related to the CryptoBilis incident.

CryptoBilis announced in an X post on Saturday that it has suspended the sale and shipment of all brands of hardware wallets across Malaysia, the Philippines and Indonesia, expanding the previous suspension limited to Ledger devices.

The retailer also temporarily closed its physical stores and said it was reviewing its processes with independent experts.

Trezor said on Monday that it has not received any reports of tampering with Trezor devices sold through CryptoBilis and has found no indication that its products have been affected. However, it removed CryptoBilis from its authorized dealer network.

OneKey also reported no related user losses, but terminated CryptoBilis' license to sell. It also suspended entry into new dealerships and began reviewing its existing distribution network. The company offered free replacements for OneKey devices purchased from CryptoBilis between March 1 and October 12, 2026, and customers could apply through Dec. 31.