TheBlock
Ledger has confirmed that a hardware implant inside its signers sold by Southeast Asian reseller CryptoBilis captures the 24-word recovery phrase during device setup and transmits it over LTE using a provisioned eSIM. The company's Donjon security team said the implant does not modify the device's Secure Element, the Ledger operating system, or any transactions and signatures. Onchain researchers estimate losses above $86 million across Bitcoin, Ethereum and Tron, though Ledger says neither the total nor the number of affected users has been verified.
Why it matters
The attack bypasses the device's core security model without tampering with it. Because the implant lifts the recovery phrase at setup, victims lose every asset the phrase controls, including holdings later moved to fresh wallets. Ledger says it has no indication its own infrastructure or services were compromised and has asked CryptoBilis to pause all sales and shipments while its team examines recovered hardware.
The blast radius is widening beyond the original reseller. MediaMarkt Saturn stopped selling Ledger devices in stores and online as of Oct. 13 after a German customer reported an implant, though no funds were lost in that case. Former Mt. Gox CEO Mark Karpelès separately said a Ledger Flex bought at Singapore's airport contained a spy implant, a claim Ledger has not confirmed as linked to the same operation.
Market impact
Rivals are treating the episode as a supply-chain wake-up call. Trezor has removed CryptoBilis and is shrinking its wider reseller network, with notified partners losing authorization on Jan. 1, 2027. OneKey revoked the reseller entirely and is offering free replacements for devices bought through CryptoBilis between March 1 and Oct. 13.
The lesson for holders is channel discipline: buy directly from manufacturers and treat third-party units as untrusted until verified. What to watch next is a verified loss figure from Ledger and any law-enforcement action that pins down the operation's origin.
Frequently asked questions
-
How does the Ledger implant steal the recovery phrase?
It captures the 24-word phrase during device setup and transmits it over LTE through a provisioned eSIM, without modifying the Secure Element, the Ledger operating system, or transaction signatures.
-
How much money was lost in the CryptoBilis Ledger implant incident?
Onchain researchers estimate more than $86 million across Bitcoin, Ethereum and Tron, but Ledger says the figures and the number of affected users remain unverified.
-
Did Ledger's own systems get hacked?
No. Ledger says it has no indication its infrastructure, systems or services were compromised. The implants were found in units sold through the reseller CryptoBilis, which Ledger has asked to pause sales and shipments.
-
Has MediaMarkt stopped selling Ledger devices?
Yes. MediaMarkt Saturn suspended in-store and online sales of Ledger devices as of Oct. 13 after a customer in Germany reported an implant, with no loss of funds reported in that case.
-
What should I do if I bought a Ledger from CryptoBilis?
Ledger advises coordinating with law enforcement before opening the signer. OneKey is offering free replacements for its devices bought through CryptoBilis between March 1 and Oct. 13, and Trezor has removed the reseller as a precaution.
CoinTelegraph
Crypto News
CoinDesk
CryptoSlate
Lookonchain
WatcherGuru