BitcoinWorld Ledger: LTE Implants in CryptoBilis Wallets Stole Seed Phrases Ledger says unauthorized implants hidden inside hardware wallets sold by Southeast Asian reseller CryptoBilis quiet
BitcoinWorld
Ledger: LTE Implants in CryptoBilis Wallets Stole Seed Phrases
Ledger says unauthorized implants hidden inside hardware wallets sold by Southeast Asian reseller CryptoBilis quietly captured users’ 24-word recovery phrases and shipped them out over cellular networks, a finding that has triggered a reseller shutdown and pulled two rival manufacturers out of their distribution agreements. The disclosure came via a Tuesday post on X from Ledger Donjon, the company’s security research team, and was reported by Cointelegraph.
Ledger says the implant sat inside the wallet casing, read the seed phrase off the screen during initial setup, and exfiltrated it via LTE using an embedded eSIM. The component did not touch the secure chip, the system software, or transaction signing, and confirmed losses so far trace back to devices sold through CryptoBilis.The technical picture, as Ledger describes it, is narrow but effective: a microcontroller decodes the recovery phrase at the moment a new wallet displays it for backup, then a cellular module with its own eSIM pushes the words off the device — no tampering with the signing path required. Ledger says it has sold more than 8 million hardware wallets, devices built to keep private keys offline and confirm transactions on-screen.
CryptoBilis was listed as an authorized reseller in Indonesia, Malaysia and the Philippines. The problem surfaced publicly on Oct. 9, when crypto losses tied to Ledger devices bought through the reseller began circulating. Ledger confirmed on Oct. 10 that one affected user’s device contained an unauthorized component, according to PANews.
Cointelegraph lays out the device-level details — the microcontroller, the eSIM, the LTE channel — and stresses that neither the security chip nor transaction approval was modified. PANews’ write-up of the same Ledger post matches that description almost point for point, adding that the component sits inside the casing and that the total number of affected users remains unverified.
Where the two reports part ways is the damage estimate. Cointelegraph cites Specter’s figure of more than $86 million and Yfarmx’s revised estimate of $103 million, while noting that Ledger has not confirmed a total; PANews states that all confirmed fund losses involve devices sold through CryptoBilis without endorsing a dollar amount. The gap between the two third-party estimates is itself the clearest signal that the number is still being assembled.
The incident may not be limited to one distributor. Ledger says it is reviewing reports that fall outside CryptoBilis, and PANews reports the same widening scope, describing an investigation into similar implant reports involving other resellers and regions. Cointelegraph adds a concrete example: an X user named Johannes said he bought two Ledger devices from separate MediaMarkt stores in Europe and found implants in both. Ledger has not confirmed whether those European devices connect to the CryptoBilis batch.
Self-custody relies on a single premise — that the recovery phrase never leaves the device except when the owner writes it down. This implant does not break cryptography; it attacks the moment of display, which means a compromised unit can look and behave exactly like a genuine one until the seed has already been sent. That is a harder problem to spot than a firmware flaw, because nothing in the wallet’s normal operation signals anything wrong.
The fallout is also hitting the distribution layer, not just the manufacturer. Two competing wallet brands cut CryptoBilis off even after saying they had found no evidence their own products were affected — a sign that resellers, not just devices, are now part of the trust calculation for buyers. CryptoBilis has said it is reviewing its processes with independent specialists.
Ledger is directing anyone who suspects tampering to contact its support team, file a police report, and consult an inspection guide. That guide carries a practical warning: opening a device can damage it, so users are told to back up their recovery phrases first.
Two open threads will shape the next phase. Ledger has yet to publish a verified count of affected users or a total loss figure, and it is still investigating whether implants appeared through resellers other than CryptoBilis. On the reseller side, OneKey’s replacement window for devices bought from CryptoBilis between March 1 and Oct. 12 runs through Dec. 31, giving affected buyers a firm deadline to act.
According to Ledger, the component sat inside the device casing, read what appeared on the screen, decoded the 24-word recovery phrase shown during initial setup, and sent it out over LTE using a built-in eSIM.
Did the implant break the wallet’s security chip?No. Both Ledger and PANews’ account of the company’s post say the component did not alter the secure chip, the wallet system, or the transaction signing process.
Which companies stopped working with CryptoBilis?Trezor removed CryptoBilis from its authorized reseller network and OneKey terminated the reseller’s authorization, according to Cointelegraph. CryptoBilis also suspended sales and shipments of all hardware wallet brands across three Southeast Asian markets.
How large were the losses from the incident?Estimates from third parties differ: blockchain investigator Specter put potential losses above $86 million and Yfarmx raised its own estimate to $103 million, but Ledger has not confirmed a total.
Were any wallets sold outside CryptoBilis affected?Ledger is examining reports beyond that reseller, and an X user named Johannes said he found implants in two Ledger devices bought from separate MediaMarkt stores in Europe. Ledger has not confirmed a link between the European reports and the CryptoBilis batch.
This post Ledger: LTE Implants in CryptoBilis Wallets Stole Seed Phrases first appeared on BitcoinWorld.
