Ledger says LTE implants in CryptoBilis-sold wallets leaked recovery phrases
In brief
- Ledger said implants in CryptoBilis-sold wallets captured recovery phrases and sent them over LTE.
- Ledger said the devices' security chips weren't compromised and transactions weren't altered.
- Specter estimated losses could exceed $86 million; Yfarmx put them at $103 million.
- Ledger hasn't confirmed a total loss figure.
- Trezor and OneKey dropped CryptoBilis as an authorized reseller.
How the implants worked
Ledger Donjon (the company's security research team) found the implants used a microcontroller to decode the 24-word phrase shown during setup, according to a Tuesday X post by Ledger reported by Cointelegraph. So how did the phrases leave the device? Through an embedded SIM, which sent the data out over LTE networks.
The incident surfaced Friday after crypto losses were reported involving devices sold through CryptoBilis. Ledger confirmed Saturday that one affected device contained an unauthorized implant.
Loss estimates vary
Blockchain investigator Specter said losses could exceed $86 million. Cybersecurity outlet Yfarmx raised its own estimate to $103 million.
Ledger hasn't confirmed a total.
The company, which says it's sold more than 8 million hardware wallets, said it's examining reports beyond CryptoBilis, although confirmed losses so far involve devices sold by the reseller. It's urged anyone who suspects tampering to contact its support team and file a police report. Customers who bought devices elsewhere were directed to an inspection guide (it warns that opening a device can damage it and advises backing up recovery phrases first).
Reseller fallout
CryptoBilis said in an X post on Saturday that it had suspended sales and shipments of all hardware wallet brands across Malaysia, the Philippines and Indonesia, widening an earlier halt that covered only Ledger devices. It also temporarily closed its physical stores and said it's reviewing its processes with independent specialists.
Trezor said Monday it hadn't received any reports of tampered Trezor devices sold through CryptoBilis and found no indication its products were affected. It removed CryptoBilis from its authorized reseller network anyway.
OneKey also reported no related user losses but terminated CryptoBilis' reseller authorization. The wallet maker suspended onboarding of new resellers and began reviewing its existing distribution network. It's offering free replacements for OneKey devices bought from CryptoBilis between March 1 and Oct. 12, 2026, with applications open through Dec. 31.
Frequently asked questions
How did the implants in CryptoBilis-sold Ledger wallets steal recovery phrases?
Ledger Donjon, Ledger's security research team, found the implants used a microcontroller to decode the 24-word phrase shown during setup. The data was then sent over LTE networks via an embedded SIM, according to Ledger's Tuesday X post.
Were Ledger's security chips compromised?
No. Ledger said the implants didn't compromise the devices' security chips or alter transactions. The implants captured recovery phrases from device screens instead.
How much was lost in the CryptoBilis wallet incident?
Blockchain investigator Specter said losses could exceed $86 million, and cybersecurity outlet Yfarmx raised its estimate to $103 million. Ledger hasn't confirmed a total.
