Ledger says an unauthorised hardware implant found in devices sold by Southeast Asian reseller CryptoBilis records customers’ 24-word recovery phrases during setup and sends them via LTE through a provisioned eSIM.
The company’s Donjon security team said in an X post on Tuesday that the implant does not alter the device’s Secure Element or Ledger operating system. It also does not change transactions or signatures.
Ledger began investigating the case last week after users who bought products from CryptoBilis reported losing funds. Onchain researchers estimated the losses at more than $86 million across Bitcoin, Ethereum and Tron.
However, Ledger said neither the total amount lost nor the number of affected users had been verified.
“Figures circulating online come from third parties and Ledger has not fully verified them,” the company said. “If you lost funds, coordinate with law enforcement before opening the signer.”
Ledger added that it had found no evidence that its infrastructure, systems or services had been compromised. It has asked CryptoBilis to stop sales and shipments while its cybersecurity team examines recovered devices.
MediaMarkt suspends Ledger sales
MediaMarkt Saturn removed Ledger products from its shops and online platforms on 13 October after a customer in Germany reported finding an implant. Ledger said no loss of funds had been reported in that case.
“We take this incident very seriously,” a MediaMarkt Saturn spokesperson told The Block. “The MediaMarktSaturn Retail Group has removed all of the manufacturer’s affected products from its stores and online platforms and is in contact with the manufacturer.”
On Friday, an X user known as Johannes said he had purchased two Ledger devices from different MediaMarkt stores and discovered unauthorised cables and cellular modules in both. Those claims have not been independently verified.
Former Mt. Gox chief executive Mark Karpeles also said on Tuesday that a Ledger Flex bought at Singapore’s airport contained a spy implant. Ledger directed users to its CryptoBilis investigation update but did not confirm whether the Singapore device was connected to the same incident.
Trezor reviews reseller network
The incident has prompted other hardware wallet manufacturers to review their reseller arrangements.
Trezor said it had received no reports of tampered devices from CryptoBilis and had no indication that its products were affected. It nevertheless removed CryptoBilis from its reseller list as a precaution.
The company is also reducing its wider reseller network, according to a letter from Chief Commercial Officer Danny Sanders to partners. Resellers affected by the change will lose their authorisation on 1 January 2027 and will receive no further stock from Trezor, although they may continue selling existing inventory until then.
“There is not a single piece of evidence that Trezor devices have been compromised,” Sanders wrote. “This is a preventive step, taken out of an abundance of caution.”
OneKey said it had recorded no customer fund losses linked to the incident. It has revoked CryptoBilis’ reseller authorisation and begun reviewing its broader network. Sellers operating under questionable legal entities will also lose authorisation.
OneKey is offering free replacements for devices bought through CryptoBilis between 1 March and 13 October, regardless of model or activation status.
