Ledger Traces LTE Spy Implants in CryptoBilis Wallet Devices

Ledger says it has identified the method behind malicious implants found in some hardware wallets sold through reseller CryptoBilis. In a Tuesday X post, the company’s security team said the devices used a microcontroller to capture users’ 24-word recovery phrases from the setup screen and then transmit the data over cellular networks via an embedded SIM (eSIM).

Ledger also stressed that the implants, as described, did not compromise the wallets’ secure element chips or modify transactions. Still, the discovery has triggered escalating fallout across the region where CryptoBilis operated and sparked distribution changes among other wallet vendors.

Key takeaways

• Ledger’s investigation attributes the recovery-phrase theft to a microcontroller-based implant that reads the words shown during wallet setup.
• The company says the implant sends captured phrases over LTE using an embedded SIM (eSIM), while not altering secure chips or transactions.
• Confirmed losses have been linked so far to devices sold through CryptoBilis, but Ledger is investigating other reports that may be outside the reseller’s network.
• CryptoBilis announced it is suspending hardware wallet sales and shipments across Malaysia, the Philippines, and Indonesia, and temporarily closing physical stores.
• Other wallet firms—such as Trezor and OneKey—have removed or terminated CryptoBilis from their authorized reseller programs despite reporting no confirmed exposure in their own lines.

How Ledger says the implant worked

Ledger’s Donjon security research team said the malicious implants were installed in some Ledger hardware wallets distributed by CryptoBilis and that the devices captured recovery phrases during the setup flow. According to Ledger’s Tuesday X update, the implants used a microcontroller to decode the 24-word phrases displayed on the screen and transmitted the extracted information over cellular connectivity using an eSIM.

In the same update, Ledger said the implant approach did not attack the wallets’ security chips or change what users approve. That distinction matters: recovery phrases are effectively a master key for self-custody. If an attacker can obtain those words, they can reconstruct access without needing to tamper with transaction logic.

Ledger did not confirm a total loss figure publicly in the provided reporting. However, the incident came into focus after crypto losses were reported following the discovery of the compromised devices associated with CryptoBilis. Blockchain investigator Specter said losses could exceed $86 million, while cybersecurity outlet Yfarmx raised an estimate to $103 million; both figures are attributed to their respective outlets and Ledger has not endorsed a final total.

Why the reseller link became central

The timing of the investigation is tied to the reseller channel. Earlier coverage from Cointelegraph noted that losses were associated with Ledger devices sold through CryptoBilis, a reseller listed as authorized in Indonesia, Malaysia, and the Philippines. Ledger later confirmed that at least one affected device contained an unauthorized implant.

Ledger has also pointed to user safety actions. The company urged anyone who suspects tampering to contact its support team and file a police report. It also provided an inspection guide for customers who purchased devices elsewhere, warning that opening a device could damage it and recommending users back up their recovery phrases first.

Although the confirmed cases so far involve CryptoBilis-distributed devices, Ledger said it is still examining reports beyond that reseller network. This is a key uncertainty for users and investors: if the issue extended to other supply routes, the risk calculus would change significantly.

Expanding reports beyond CryptoBilis

Ledger’s comments indicate that the company views the CryptoBilis incident as part of a broader investigation rather than a closed event. The report includes separate user-submitted claims from outside the original reseller geography.

An X user identified as Johannes posted photos of two Ledger devices that he said he purchased from MediaMarkt, a European consumer electronics chain. He claimed he found implants in both devices. Ledger has not confirmed whether those European reports connect to the CryptoBilis incident, but the existence of independent accounts is exactly the kind of signal that tends to drive follow-up testing by hardware wallet manufacturers.

For customers, the practical implication is straightforward: buying from an authorized seller can reduce risk, but it does not eliminate the need for verification if tampering is suspected. The more difficult part is that hardware wallets are meant to be used with minimal friction, so the line between “safe inspection” and “potentially damaging investigation” becomes important—hence Ledger’s warning about opening devices.

CryptoBilis suspends sales; competitors cut ties

While Ledger continued its technical review, CryptoBilis moved to shut down distribution. In an X post on Saturday, the reseller said it had suspended sales and shipments of all hardware wallet brands across Malaysia, the Philippines, and Indonesia. Ledger devices were previously the focus of an earlier halt limited to that brand.

CryptoBilis also said it temporarily closed its physical stores and was reviewing its processes with independent specialists.

The ripple effect extended to other wallet vendors. Trezor said Monday that it had received no reports of tampered Trezor devices sold through CryptoBilis and found no indication that its products were affected. Despite that, Trezor removed CryptoBilis from its authorized reseller network.

OneKey similarly reported no related user losses, but it terminated CryptoBilis’ reseller authorization. OneKey also suspended onboarding new resellers and began reviewing its existing distribution network. The company offered free replacements for OneKey devices purchased from CryptoBilis between March 1 and Oct. 12, 2026, with customers able to apply through Dec. 31.

These actions highlight a common pattern in hardware wallet incidents: even when a specific vendor has not confirmed compromises in its own product line, authorized distribution partners can become liabilities, forcing rapid program changes to protect users.

Going forward, the key things readers should watch are (1) whether Ledger confirms additional affected supply routes beyond CryptoBilis, (2) whether independent reports from retail channels in Europe or elsewhere are verified in a way that matches the described implant mechanism, and (3) how replacement and verification guidance evolves as investigators narrow down the source and scope of the compromised devices.