Ledger Confirms Implants in CryptoBilis-Sold Devices; MediaMarkt Halts European Sales

Ledger confirms recovery-phrase theft through hidden implants

Ledger has confirmed that some of its hardware signers (physical devices used to safely store cryptocurrency keys) sold through the Southeast Asian reseller CryptoBilis contained unauthorized hardware implants. According to Ledger's Donjon security team, the implants read the 24-word recovery phrase (a secret backup code that gives full access to a wallet) during device setup and transmit it over cellular LTE using a built-in eSIM.

On Tuesday, Ledger said the implants do not change the device's Secure Element (the built-in chip that holds private keys), the Ledger operating system, or any transactions and signatures. The company also stated it has no evidence its own infrastructure, systems, or services were compromised. Ledger has asked CryptoBilis to pause all sales and shipments while its cybersecurity team examines recovered hardware.

Ledger first announced an investigation into fund losses tied to CryptoBilis purchases last week. Onchain researchers estimated losses exceeding $86 million across Bitcoin, Ethereum, and Tron, but Ledger says this figure and the number of affected users remain unverified. "Figures circulating online come from third parties and Ledger has not fully verified them," the company's post stated, urging anyone who lost funds to coordinate with law enforcement before opening the device.

Key facts at a glance

• Implants capture the 24-word recovery phrase during setup and send it over LTE via a provisioned eSIM.
• Onchain researchers estimate losses over $86 million across Bitcoin, Ethereum, and Tron; Ledger has not confirmed this number.
• Ledger has not found evidence that its own systems were compromised.
• Ledger has asked CryptoBilis to halt all sales and shipments pending investigation.
• MediaMarkt Saturn removed Ledger products from stores and online platforms across Europe as of October 13.

What Ledger said about the compromise

Ledger's official update on Tuesday confirmed the presence of the implants but drew clear lines around what they do and do not affect. The implants do not alter the Secure Element, the Ledger OS, or any signed transactions. Ledger emphasized that it has no indication its own infrastructure was breached and recommended that affected users contact law enforcement before opening the device.

MediaMarkt stops Ledger sales across Europe

MediaMarkt Saturn, a major European electronics retailer, halted sales of Ledger devices in stores and online as of October 13 after a customer in Germany reported finding an implant inside a unit. Ledger confirmed that no funds were lost in that particular case.

"We take this incident very seriously," a MediaMarkt Saturn spokesperson told The Block. "The MediaMarktSaturn Retail Group has removed all of the manufacturer's affected products from its stores and online platforms and is in contact with the manufacturer."

Separately, an X user known as Johannes claimed to have bought two Ledger devices from different MediaMarkt stores and found unauthorized cables and cellular modules inside both. These claims have not been independently verified. Former Mt. Gox CEO Mark Karpelès also posted on Tuesday that a Ledger Flex device purchased at Singapore's airport contained a spy implant. Ledger referred users to its CryptoBilis investigation update but did not confirm whether the Singapore device was connected to the same incident.

Other wallet makers respond with precautionary measures

Trezor said it has no reports of tampered devices from CryptoBilis and no indication its own products were affected. Nevertheless, the company removed CryptoBilis from its authorized reseller list as a precaution. In a letter to partners from Chief Commercial Officer Danny Sanders, Trezor announced it would also shrink its broader reseller network. Resellers notified under the plan will lose authorization on January 1, 2027, and will receive no new stock, though they can sell remaining inventory until then. "There is not a single piece of evidence that Trezor devices have been compromised," Sanders wrote. "This is a preventive step, taken out of an abundance of caution."

OneKey, another hardware wallet maker, reported no customer fund losses linked to the incident. The company revoked CryptoBilis' reseller authorization and began reviewing its wider reseller network, stating that sellers under questionable legal entities will lose authorization. OneKey is offering free replacements for devices purchased through CryptoBilis between March 1 and October 13, regardless of model or activation status.

What is confirmed and what remains unclear

Confirmed: Implants exist in some CryptoBilis-sold Ledger devices. The implants capture recovery phrases and transmit them over LTE. MediaMarkt Saturn has removed Ledger products. Trezor and OneKey have revoked CryptoBilis' authorization. OneKey is offering free replacements for devices bought through CryptoBilis during the specified period.

Still unclear: The total dollar amount of losses (the $86 million+ figure comes from third-party researchers and has not been verified by Ledger). The exact number of affected users. Whether the devices reported by Johannes at MediaMarkt stores and the Singapore airport device are connected to the CryptoBilis incident. Whether any funds were stolen from the German customer who found the implant at MediaMarkt (Ledger said no funds were lost in that case).

Why this matters

Hardware wallets are designed to be a secure way to store cryptocurrency keys offline, reducing the risk of online theft. A hidden implant that can silently read and transmit recovery phrases undermines that core security model. For users who bought their devices through a reseller rather than the manufacturer directly, this incident highlights the risk of third-party supply chains. Ledger's own infrastructure does not appear to be affected, but the widespread use of reseller channels means many users may have unknowingly received tampered devices.

Sources

• The Block