Ledger says malicious hardware-wallet implants sold through CryptoBilis captured customers’ recovery phrases and transmitted them over LTE, prompting the reseller to halt sales and rival wallet makers Trezor and OneKey to sever ties.
According to Cointelegraph, Ledger’s security research division, Ledger Donjon, found that the implants used a microcontroller to read the 24-word phrases shown on a device screen during setup. The implant then sent the information through cellular networks using an embedded SIM, or eSIM.
A recovery phrase is the sequence of words that can restore access to a cryptocurrency wallet. Because control of the phrase can provide access to the assets held by the wallet, its exposure can create a serious security risk. Ledger said, however, that the implants did not break into the devices’ security chips or modify transactions.
The incident became public after cryptocurrency losses were reported involving Ledger devices sold by CryptoBilis, a reseller listed as authorized in Indonesia, Malaysia and the Philippines. Ledger confirmed on Saturday that at least one affected device contained an unauthorized implant.
The amount reportedly lost remains disputed. Blockchain investigator Specter estimated that losses could exceed $86 million, while cybersecurity outlet Yfarmx put its estimate at $103 million. Ledger has not confirmed either figure.
Ledger investigates the scope of the tampering
Ledger said it is examining reports involving devices beyond CryptoBilis, although the confirmed losses so far relate to products sold by that reseller. The company has asked customers who suspect their devices were tampered with to contact Ledger support and file a police report.
Customers who bought Ledger devices through other channels were directed to an inspection guide. The guide cautions that opening a wallet can damage it and advises users to back up their recovery phrases before attempting an inspection.
The investigation has also drawn attention to reports from Europe. An X user identified as Johannes posted photographs of two Ledger devices that he said were purchased from separate MediaMarkt stores, a European consumer-electronics chain. He said both contained implants. Ledger has not confirmed whether those reports are connected to the CryptoBilis case.
Ledger says it has sold more than 8 million hardware wallets. These devices are designed to keep private keys offline and allow users to approve transactions on the device itself. The reported attack targeted the recovery phrase during setup rather than the security chip or the transaction approval process.
CryptoBilis suspends sales, while rivals end authorizations
CryptoBilis announced on Saturday that it had stopped sales and shipments of all hardware-wallet brands in Malaysia, the Philippines and Indonesia. Its initial suspension had applied only to Ledger devices. The reseller also temporarily closed its physical stores and said it was reviewing its procedures with independent specialists.
Trezor said on Monday that it had received no reports of tampered Trezor products sold through CryptoBilis and had found no indication that its devices were affected. Despite that, Trezor removed CryptoBilis from its authorized reseller network.
OneKey also said it had no related reports of user losses, but ended CryptoBilis’ reseller authorization. OneKey further suspended the onboarding of new resellers and began reviewing its existing distribution network.
The company offered free replacements for OneKey devices bought through CryptoBilis between March 1 and Oct. 12, 2026. Eligible customers can apply for a replacement until Dec. 31.
Market picture
Moneyiar market data at 09:44 on Oct. 13, 2026, showed several tracked crypto assets lower over both 24 hours and seven days:
- Solana (SOL): $107.208031969, down 3.73% in 24 hours and 10.22% over seven days.
- Ethena (ENA): $0.214409022, down 8.44% in 24 hours and 10.52% over seven days.
- edgeX (EDGE): $0.3366653885, down 6.21% in 24 hours and 25.67% over seven days.
- Ailey (ALE): $0.2680564299, down 0.13% in 24 hours and 0.61% over seven days.
The wallet incident is separate from these market movements. It does, however, highlight the importance of how recovery phrases are generated, displayed and handled when users set up self-custody devices. The investigation remains ongoing, and Ledger has not confirmed the total value of losses or whether reports outside the CryptoBilis distribution network are connected.
