Ledger says spy implants in CryptoBilis wallets stole recovery phrases via cellular networks
Implants in wallets decoded recovery phrases and sent them over cell networks
Ledger said that malicious hardware implants in wallets sold by reseller CryptoBilis captured users' recovery phrases and transmitted them over LTE cellular networks.
The French hardware wallet company said its security research team, Ledger Donjon, found that the devices contained a microcontroller that decoded the 24-word recovery phrases shown on screens during setup. The implant used an embedded SIM, or eSIM, to send the data out over a cellular network.
Ledger stressed that the implants did not breach the devices' security chips or change any transactions. They only recorded the phrases displayed on the screen.
The breach came to light on Friday after reports of crypto losses linked to Ledger devices sold through CryptoBilis, a reseller authorized in Indonesia, Malaysia, and the Philippines.
Key figures in the incident
- CryptoBilis is an authorized reseller in Indonesia, Malaysia, and the Philippines.
- Blockchain investigator Specter estimated losses could exceed $86 million. Cybersecurity outlet Yfarmx raised its estimate to $103 million. Ledger has not confirmed a total figure.
- Ledger has sold more than 8 million hardware wallets to date.
- Ledger Donjon is the company's internal security research team.
What Ledger has said about the investigation
Ledger urged anyone who suspects tampering to contact its support team and file a police report. It also published an inspection guide for customers who bought devices from other sellers, warning that opening a device could damage it and advising users to back up recovery phrases first.
While confirmed losses involve CryptoBilis devices, Ledger said it is reviewing reports outside the reseller. X user Johannes posted photos of two Ledger devices from MediaMarkt, a European electronics chain, claiming both contained implants. Ledger has not confirmed whether those cases are linked to CryptoBilis.
Competitors cut ties; CryptoBilis suspends sales
CryptoBilis said on Saturday that it suspended sales and shipments of all hardware wallet brands across Malaysia, the Philippines, and Indonesia. It had previously halted only Ledger sales. The company also temporarily closed its physical stores and said it was reviewing its processes with independent specialists.
Trezor said Monday that it had received no reports of tampered Trezor devices sold through CryptoBilis and found no sign its own products were affected. Nevertheless, it removed CryptoBilis from its authorized reseller network.
OneKey also reported no related losses but terminated CryptoBilis' reseller authorization. It suspended new reseller onboarding and began reviewing its existing distribution network. OneKey offered free replacements for devices purchased from CryptoBilis between March 1 and Oct. 12, 2026, with applications accepted through Dec. 31.
Why this matters for wallet users
Hardware wallets store private keys offline, keeping them separate from internet-connected devices where hackers are more likely to strike. A recovery phrase is the list of words that lets a user restore access to those keys. If an implant records those words while they appear on screen, an attacker can reconstruct the wallet and move funds without ever touching the device's secure chip.
What happens next
Ledger is continuing to examine reports beyond CryptoBilis. CryptoBilis is working with independent specialists to review its processes. OneKey is accepting replacement requests until Dec. 31, 2026.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.