Ledger Reveals Security Flaw in Wallets Sold by CryptoBilis
Ledger has reported that malicious implants embedded in wallets sold by CryptoBilis have been capturing users' recovery phrases displayed on device screens and transmitting them over cellular networks. This alarming discovery was made by Ledger Donjon, the company's security research team, which found that the implants utilized a microcontroller to decode the 24-word recovery phrases and sent the data via LTE networks using an embedded SIM (eSIM). Ledger emphasized that these implants did not compromise the security chips of the devices or alter any transactions.
The issue came to light after reports of significant crypto losses involving Ledger devices sold through CryptoBilis, a reseller that was authorized in Indonesia, Malaysia, and the Philippines. Ledger confirmed that at least one affected device was found to contain an unauthorized implant. Blockchain investigator Specter estimated that the losses could exceed $86 million, while cybersecurity outlet Yfarmx suggested the figure could be as high as $103 million, although Ledger has not verified the total amount of losses.
With over 8 million hardware wallets sold, Ledger's devices are designed to keep users' private keys offline, allowing them to approve transactions directly on the device. In light of the situation, Ledger has urged users who suspect their devices may have been tampered with to reach out to its support team and file a police report. The company has also provided an inspection guide for concerned customers who purchased devices from other sources, advising them to back up their recovery phrases before attempting to open the devices, as doing so could cause damage.
Investigation Expands Beyond Initial Reseller
While the confirmed losses have so far been linked to devices sold by CryptoBilis, Ledger is investigating reports that may extend beyond this reseller. In a related incident, a user on X shared images of two Ledger devices purchased from separate MediaMarkt stores, claiming to have found implants in both. Ledger has yet to confirm whether these European reports are connected to the CryptoBilis situation.
Final Brief
In response to the revelations, CryptoBilis announced on X that it has suspended sales and shipments of all hardware wallet brands across Malaysia, the Philippines, and Indonesia, expanding an earlier halt that was limited to Ledger devices. The reseller has also temporarily closed its physical stores and is reviewing its processes with independent specialists.
Trezor, another hardware wallet manufacturer, stated that it has not received any reports of tampered Trezor devices sold through CryptoBilis and found no evidence that its products were affected. Nevertheless, Trezor has removed CryptoBilis from its authorized reseller network. OneKey also reported no related user losses but has terminated CryptoBilis' reseller authorization and suspended onboarding new resellers while reviewing its existing distribution network. The company is offering free replacements for OneKey devices purchased from CryptoBilis between March 1 and October 12, 2026, with customers able to apply until December 31.
