Ledger’s security team identified cellular implants in a subset of its hardware wallets that were distributed by the reseller CryptoBilis. The chips recorded users’ seed phrases during setup and exfiltrated the data over a built-in LTE connection, resulting in multi-million-dollar thefts.
LTE-enabled implants discovered
Ledger’s internal research group, Donjon, reported that the implants employed a tiny microcontroller to read the 24-word recovery phrase displayed on the device screen. The extracted phrase was then sent through an embedded SIM card using LTE networks. The implants did not tamper with the device’s secure element or alter transaction signing.
Financial impact and loss estimates
Initial reports of stolen funds emerged after users of Ledger wallets purchased from CryptoBilis experienced unexplained losses. Independent blockchain analyst Specter placed the total loss at over $86 million, while cybersecurity outlet Yfarmx suggested the figure could be as high as $103 million. Ledger has not disclosed an official total.
Response from Ledger and other manufacturers
Ledger instructed owners who suspect tampering to contact support, file a police report, and follow an inspection guide that cautions against opening the device. The company also confirmed that it is reviewing reports of compromised wallets beyond the CryptoBilis channel. CryptoBilis announced a suspension of all hardware-wallet sales and shipments across Malaysia, the Philippines and Indonesia, and temporarily closed its physical stores while it conducts an internal review with external experts. Trezor, which had no confirmed incidents involving its devices sold by CryptoBilis, removed the reseller from its authorized network as a precaution. OneKey reported no direct losses but also terminated CryptoBilis’s reseller status and offered free replacements for OneKey wallets bought between March 1 and October 12 2026, with claims accepted through December 31.
Wider supply-chain concerns
While the confirmed cases involve devices sold by CryptoBilis, Ledger noted that similar implants were found in two Ledger units purchased from a European electronics chain, MediaMarkt. The company has not yet linked those findings to the CryptoBilis incident, but the reports highlight potential vulnerabilities in the broader distribution ecosystem for hardware wallets.
Why it matters
The breach underscores the critical importance of hardware-wallet supply-chain integrity. Users rely on offline devices to protect private keys, and any covert modification that captures seed phrases can undo that security model. The incident may drive manufacturers to tighten reseller vetting, introduce tamper-evident packaging, and increase user awareness of inspection procedures. It also serves as a reminder that even air-gapped devices can be compromised through embedded communication modules, prompting a reassessment of trust assumptions in crypto custody solutions.
