Ledger reported that hardware wallets sold by the reseller CryptoBilis contained unauthorized LTE-enabled implants. These devices used a microcontroller to capture 24-word recovery phrases during setup and transmitted the data via an embedded SIM. The company clarified that the implants did not alter the security chips or transaction processes.
The issue was identified following reports of crypto losses linked to devices purchased through CryptoBilis, an authorized reseller in Indonesia, Malaysia, and the Philippines. While blockchain investigator Specter estimated potential losses at over $86 million, cybersecurity outlet Yfarmx suggested the figure could reach $103 million. Ledger has not yet confirmed the total.
In response, CryptoBilis suspended all sales and shipments of hardware wallets and closed its physical stores to conduct a review. Trezor and OneKey subsequently terminated their partnerships with the reseller. OneKey is offering free replacements for devices purchased from CryptoBilis between March 1 and Oct. 12, 2026, with applications open until Dec. 31.
Ledger is currently investigating reports of similar implants in devices purchased from other retailers, including a claim from a user regarding products bought at MediaMarkt in Europe. The company has advised customers who suspect tampering to contact support and file a police report, while providing an inspection guide for those who purchased devices from third-party sources.
