Ledger has confirmed that hardware implants were found in some of its devices sold by Southeast Asian reseller CryptoBilis, creating a physical supply-chain risk that could expose users’ 24-word recovery phrases before they ever complete setup.
Ledger’s Donjon security team said the implant was designed to capture the recovery phrase displayed during device initialization and transmit it through an LTE connection using a provisioned eSIM. The device modification did not alter Ledger’s Secure Element, the company’s operating system, transaction data, or cryptographic signatures, according to an update posted by Ledger on X.
That design would allow a tampered wallet to pass normal software checks while leaking the phrase that controls a user’s assets. Anyone with a recovery phrase can restore the wallet elsewhere and move its funds without needing access to the original hardware device.
Ledger said it has found no indication that its own infrastructure, systems, or services were compromised. Its investigation instead focuses on hardware recovered from the reseller channel, where devices may have been modified after leaving Ledger’s direct control.
Ledger asks CryptoBilis to halt shipments
The disclosure follows reports last week of fund losses among customers who had bought Ledger products through CryptoBilis. Ledger said it had asked the reseller to pause all sales and shipments while its cybersecurity team examines recovered devices.
The company cautioned that the total value of stolen assets and the number of affected customers remain unverified. Ledger said figures circulating online were calculated by third parties and have not been fully confirmed by the company.
Onchain researchers had estimated losses of more than $86 million across Bitcoin, Ethereum and TRON. A separate claim that thefts had reached at least $93 million since Oct. 9 was not included in Ledger’s public update, which has not endorsed a final loss figure.
The recovery phrase theft method explains why reported losses could span several blockchains. A single 24-word phrase can generate private keys for addresses holding different assets, allowing an attacker who obtains the phrase to drain funds across supported networks.
Ledger said the implant’s ability to avoid changes to the Secure Element or operating system narrowed the practical value of ordinary firmware verification. The compromised component allegedly targeted the setup process itself, when a customer records the backup words that secure the wallet.
European retailer pauses Ledger sales
MediaMarkt Saturn halted sales of Ledger devices in stores and online across Europe on Oct. 13 after a customer in Germany reported a tampered unit, Ledger said. No loss of funds was reported in that case.
The retail group operates more than 1,000 stores across 11 European countries, making the suspension a much larger consumer-facing response than a single reseller investigation. Ledger did not state how many devices may have been sold through the chain or whether the German report was connected to the CryptoBilis case.
An X user known as Johannes said on Friday that two Ledger devices purchased from separate MediaMarkt stores contained unauthorized cables and cellular modules. Those claims have not been independently verified.
Former Mt. Gox chief executive Mark Karpelès separately said Tuesday that a Ledger Flex purchased at Singapore’s airport contained a spy implant. Ledger directed users to its CryptoBilis investigation update but did not confirm whether the Singapore device was linked to the same operation.
The reports place scrutiny on distribution and retail handling rather than Ledger’s wallet code. A hardware wallet can remain cryptographically sound while becoming unsafe if an attacker installs components capable of observing its display or transmitting sensitive information during setup.
Other wallet makers cut ties with reseller
Trezor removed CryptoBilis from its reseller list, although the company said it had received no reports of tampered Trezor devices tied to the reseller and had no indication that its own products were affected.
In a letter to partners, Trezor Chief Commercial Officer Danny Sanders said the company is reducing its wider reseller network. Resellers notified under the plan will lose authorization on Jan. 1, 2027, will receive no new stock from Trezor, and can sell their remaining inventory until that date.
OneKey also revoked CryptoBilis’ reseller authorization while reviewing its distribution network. The company said it would remove authorization from sellers operating under questionable legal entities.
OneKey said it had received no reports of customer fund losses connected to the incident. It will offer free replacements for devices purchased through CryptoBilis between March 1 and Oct. 13, regardless of model or whether the wallet was activated, according to a plan posted on X.
Recovery phrases are the immediate exposure
The most urgent risk falls on users who initialized a device later found to be tampered with. Once a recovery phrase may have been exposed, moving assets to another address generated from the same phrase does not solve the problem. The attacker could derive those addresses as well.
Users concerned that their device came from CryptoBilis or another affected retail channel should create a completely new wallet and recovery phrase using a trusted device, then transfer assets to addresses controlled by that new phrase. They should avoid entering an existing phrase into a wallet they suspect could be compromised.
Unopened devices also deserve caution. A factory-sealed box may not establish that the hardware inside has not been altered, particularly where the alleged modification is internal and designed to preserve normal device operation.
Ledger’s confirmation gives the incident a more concrete technical basis than earlier social-media reports, but major questions remain around the number of affected devices, the point in the distribution chain where they were modified, and the scale of resulting theft. The sales pauses and reseller removals show manufacturers are treating the issue as a distribution-security problem that cannot be addressed through a firmware update alone.
Worried about tampered wallets? Learn essential security habits and storage options in our guide crypto wallet mistakes to avoid today.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
