Ledger says LTE implants in CryptoBilis wallets stole seed phrases

Key takeaways

Ledger's security research team, Ledger Donjon, said unauthorized LTE implants hidden inside hardware wallets sold by Southeast Asian reseller CryptoBilis captured users' 24-word recovery phrases during setup and sent them out through an embedded eSIM. Ledger said the implant did not modify the secure chip, system software or transaction signing, and that confirmed losses so far trace to devices sold through CryptoBilis. Third-party estimates of the damage remain unverified: Specter put potential losses above $86 million, while Yfarmx raised its estimate to $103 million. CryptoBilis suspended sales and shipments of all hardware wallet brands across Malaysia, the Philippines and Indonesia, and closed its physical stores temporarily. Trezor removed CryptoBilis from its authorized reseller network, and OneKey terminated its reseller agreement while offering free replacements for devices bought from CryptoBilis between March 1 and Oct. 12, 2026, with applications open through Dec. 31.

What happened

The disclosure came in a Tuesday post on X from Ledger Donjon and was reported by Cointelegraph, with BitcoinWorld citing the account. Ledger described a narrow but effective compromise: a microcontroller inside the wallet casing decoded the recovery phrase at the moment a new wallet displayed it for backup, then a cellular module with its own eSIM pushed the words off the device over LTE. The component did not touch the signing path, so a compromised unit could look and behave like a genuine wallet until the seed phrase had already been sent.

The problem surfaced publicly on Oct. 9, when crypto losses tied to Ledger devices bought through CryptoBilis began circulating. Ledger confirmed on Oct. 10 that one affected user's device contained an unauthorized component, according to PANews. CryptoBilis was listed as an authorized reseller in Indonesia, Malaysia and the Philippines.

Market context

Hardware wallets are built to keep private keys offline and confirm transactions on-screen. Ledger says it has sold more than 8 million hardware wallets, so the incident shows that distribution and supply-chain controls can matter as much as cryptographic design. The fallout is also hitting the reseller layer. Trezor removed CryptoBilis from its authorized reseller network, and OneKey terminated the reseller agreement even after saying it had found no evidence its own products were affected. OneKey's replacement program covers free replacements for devices bought from CryptoBilis between March 1 and Oct. 12, 2026, with applications open through Dec. 31. CryptoBilis said it is reviewing its processes with independent specialists.

The incident may not be limited to one distributor. Ledger said it is reviewing reports that fall outside CryptoBilis, and PANews reported the same widening scope, describing an investigation into similar implant reports involving other resellers and regions. Cointelegraph added a concrete example: an X user named Johannes said he bought two Ledger devices from separate MediaMarkt stores in Europe and found implants in both. Ledger has not confirmed whether those European devices connect to the CryptoBilis batch. PANews also noted that the total number of affected users remains unverified.

Why it matters

Self-custody relies on a single premise: that the recovery phrase never leaves the device except when the owner writes it down. This implant does not break cryptography; it attacks the moment of display. That makes it harder to spot than a firmware flaw, because nothing in the wallet's normal operation signals anything wrong. The user may be completing a standard backup while the compromised hardware is quietly sending the words.

The response suggests that buyers are now assessing the full supply chain, not only the manufacturer. Two competing wallet brands cut CryptoBilis off even without evidence that their own devices were involved. Ledger is directing anyone who suspects tampering to contact its support team, file a police report and consult an inspection guide. That guide carries a practical warning: opening a device can damage it, so users are told to back up their recovery phrases first.

What to watch

Two open threads will shape the next phase. Ledger has not published a verified count of affected users or a confirmed total loss figure, and the gap between Specter's above $86 million estimate and Yfarmx's $103 million estimate is itself a signal that the number is still being assembled. Ledger is also still investigating whether implants appeared through resellers other than CryptoBilis, including the reports tied to MediaMarkt devices in Europe.

For buyers, OneKey's replacement window gives a firm deadline: applications for devices bought from CryptoBilis between March 1 and Oct. 12, 2026, remain open through Dec. 31. The unresolved questions are the total number of compromised units, whether the CryptoBilis batch was the only affected supply chain, and how hardware wallet makers will adjust reseller vetting as the investigation continues.