Reseller-sold Ledger wallets carried hidden LTE implants that leaked seed phrases

Ledger says implants inside hardware wallets sold by reseller CryptoBilis copied recovery phrases and sent them over LTE without touching the secure chip. Loss estimates run from more than $86 million to $103 million, and Ledger has not confirmed a total.

Ledger traces drained wallets to implants in reseller-sold devices

Ledger has confirmed that devices sold through CryptoBilis, an authorized reseller across Indonesia, Malaysia and the Philippines, carried unauthorized hardware that captured recovery phrases and transmitted them over cellular networks. Cointelegraph reported that Ledger Donjon, the company's security research team, found a microcontroller that decoded the 24-word phrases displayed during setup and sent them out over LTE through an embedded SIM.

The problem surfaced on Friday, when users in Southeast Asia who had bought devices from CryptoBilis reported losing funds, according to Decrypt. Ledger confirmed on Saturday that one of the affected devices held an unauthorized implant, and by Sunday it said every confirmed case involved the reseller.

How the implants worked around the secure chip

The Defiant reported that Ledger says the extra hardware did not modify the secure chip or the device's operating system, and that its Genuine Check is unable to exclude tampering of this kind. Cointelegraph added that, according to Ledger, transactions were not altered. The Defiant summary therefore describes an attack that sat beside the device's protections rather than breaking them.

That matters because hardware wallets keep private keys offline, yet the recovery phrase is the backup from which those keys can be rebuilt. An implant that copies the phrase as it appears on screen can leave the signing hardware looking normal while exposing the one secret that restores the wallet elsewhere.

Loss estimates diverge and the stolen funds have crossed several chains

Ledger has not confirmed a loss total. Specter, a blockchain investigator, said losses could exceed $86 million, and Cointelegraph reported that the cybersecurity outlet Yfarmx raised its own estimate to $103 million. Decrypt carried a suspected $87 million figure in its headline and said Specter's tracing of suspected thefts spans more than $86 million across the Ethereum, Tron and Bitcoin networks.

YFarmX, which Decrypt describes as onchain investigators, said it passed Ledger a list covering more than 450 drained wallets. Decrypt notes that the firm's analysis of the thief's movements has not been independently verified, and its main findings are listed below.

• 2,810 ETH passed through Tornado Cash in three runs, with withdrawals routed on through Zcash's shielded pool.
• About 3.28 million USDC went to three newly created wallets, where Circle can freeze it.
• 15 million USDT was exchanged for USDD, which Tether cannot freeze, before 5.1 million was swapped back and about 4.23 million USDT was sent to Binance deposit addresses.
• Tether froze 10 million USDT within the first day, and YFarmX lists 10 million USDD, 15,475 ETH and 203 BTC as still out of reach.

Timeline and discrepancies across the outlets' accounts

The fuller accounts agree on the sequence. Losses were reported and Ledger began investigating on Friday, Ledger confirmed an implant and CryptoBilis widened its sales halt on Saturday, and Ledger issued a 72-hour update on Sunday. Trezor responded on Monday, and Ledger's technical explanation came on Tuesday.

They differ in emphasis. Decrypt quotes Ledger's statement that "the volume of impacted devices is limited," while the investigators it cites put losses above $86 million. The Block reported that MediaMarkt suspended sales in Europe as Ledger confirmed the implant. Cointelegraph says Ledger has yet to say whether the European reports relate to the CryptoBilis case, and Decrypt adds that the claims behind them have not been independently verified.

Resellers, rival makers and a European retailer respond

In a Saturday post on X, CryptoBilis said it had stopped selling and shipping every hardware wallet brand in Malaysia, the Philippines and Indonesia, widening an earlier pause limited to Ledger devices. It also shut its brick-and-mortar shops for the time being and said independent specialists were helping it examine how the business operates.

Trezor said on Monday that no tampered Trezor devices sold through CryptoBilis had been reported to it and that it saw no sign its products were affected, but it still removed the reseller from its authorized network. OneKey reported no related user losses, terminated the reseller's authorization and paused onboarding of new resellers while it reviews its distribution network. It is offering free replacements for devices bought from CryptoBilis between March 1 and Oct. 12, 2026, with applications open through Dec. 31.

The European angle rests on X user Johannes, who said he found implants in two Ledger devices bought from separate MediaMarkt stores. Per Decrypt, he described identical modifications including additional cables and an LTE module, and he called for a recall.

What device owners and project teams can check now

Ledger's advice to buyers of CryptoBilis devices is not to set up any unused unit. Anyone who already has should shift their assets to a fresh recovery phrase on a device obtained from Ledger. Cointelegraph reports that users who suspect tampering are asked to contact Ledger support and file a police report, while owners who bought elsewhere are pointed to an inspection guide that cautions that taking a device apart may harm it and recommends backing up recovery phrases beforehand.

Ledger also reminded resellers and distributors to source stock only through authorized channels and to avoid restocking returned units. Ledger also cautioned that fraudsters could try to take advantage of the incident, and it said it "will never call you, DM you, or ask for your 24-word recovery phrase."

Teams that keep treasury or signing keys on hardware wallets can check where each device was bought, since Ledger ties every confirmed case to one reseller and warns of added risk when buying from unauthorized sellers.

Open questions the investigation has yet to answer

Ledger has said it is examining reports beyond CryptoBilis, so it remains open whether devices from other sellers carry the same modification, including the European units Johannes described. How the implants were fitted to the devices is also not addressed in the outlets' reporting.

Recovery is another open question. Tether's freeze covered 10 million USDT, Circle could freeze the USDC in three wallets according to Decrypt, and YFarmX places USDD, ETH and BTC out of reach. Ledger says it is reviewing reseller controls and has asked the wider industry to cooperate on supply-chain and anti-tamper practices, so how reseller vetting changes is worth watching.

Market snapshot

Asset	Price	24h	7d	Market cap
Bitcoin (BTC)	$83,509	+1.0%	-3.3%	$1.68 trillion
Ethereum (ETH)	$2,514	-0.6%	-7.3%	$306.95 billion
TRON (TRX)	$0.326955	-1.2%	-2.5%	$31.06 billion

CoinGecko data as of 2026-10-13 (UTC).

FAQ

How did the implants capture Ledger recovery phrases?

According to Cointelegraph, Ledger Donjon found that a microcontroller decoded the 24-word phrases displayed during setup and sent them over LTE using an embedded SIM. Ledger says the security chips were not compromised and transactions were not altered.

What should buyers of CryptoBilis-sold Ledger devices do?

Ledger advises against setting up unused devices bought from the reseller. Anyone who already did should transfer their assets to a new recovery phrase held on a device obtained from Ledger itself, and suspected tampering should be reported to Ledger support and the police.

How much was stolen in the Ledger reseller incident?

No total has been confirmed. Specter said losses could exceed $86 million, Yfarmx's estimate reached $103 million, and Ledger has not confirmed either figure.

Sources

• The Block: Ledger confirms hardware implant in CryptoBilis reseller units as MediaMarkt suspends sales in Europe (2026-10-13)
• Cointelegraph: Ledger details LTE-enabled spy implants in wallets sold by CryptoBilis (2026-10-13)
• The Defiant: Ledger Says CryptoBilis-Sold Wallet Implants Transmit Recovery Phrases Over LTE (2026-10-13)
• Decrypt: Ledger Says All Confirmed Cases in Suspected $87M Drain Tied to Reseller CryptoBilis (2026-10-12)
• CoinGecko (market data)