Covert LTE Implants in CryptoBilis-Sold Ledger Wallets Stole Recovery Phrases, With Losses Estimated Up to $93 Million

In a quiet moment of setup, a user unlocks their Ledger device. The screen lights up, displaying the twenty-four words that serve as the master key to their digital life. Unseen by the owner, a microcontroller hidden behind the OLED display reads those words from the screen itself. It encodes them into data and beams them out over an LTE mobile network via an embedded SIM card [1]coindesk.comLedger finds covert cellular implant stole hardware wallet recovery phrases from screensLedger said an unauthorized implant in some devices sold by Southeast Asian reseller CryptoBilis captured users' 24-word recovery phrases from the screen and transmitted them over a mobile network.Open source ↗[4]newscord.orgSpy chip mechanism: LTE transmission of recovery phrasesLedger said a covert component inside some Ledger devices sold by CryptoBilis transmitted wallet keys by capturing users' recovery phrases from the device screen and sending them to attackers over an LTE mobile network.Open source ↗. By the time the user finishes writing down the phrase, the attacker already possesses the ability to recreate the wallet on any other device and drain the funds without needing the physical device or changing any transactions on it [1][8]finance.yahoo.comHackers hid a spy chip in Ledger wallets to steal $93MLedger says covert hardware implanted in wallets sold by reseller CryptoBilis read users' recovery phrases off the screen and beamed them to attackers over a cellular network, stealing an estimated $93 million.Open source ↗.

This is not a software bug. It is not a cryptographic failure. It is a physical supply-chain attack of sophisticated engineering, executed against devices sold by the Southeast Asian reseller CryptoBilis [3]cryptopolitan.comLedger described the incident as a physical supply-chain attack, not a software breachLedger described the incident as a physical supply-chain attack, not a software breach.Open source ↗[5]bleepingcomputer.comLedger confirms hardware wallet spy implant behind crypto theftsLedger has confirmed that some of its devices distributed through Southeast Asian reseller CryptoBilis were compromised with a hardware implant that drained users' cryptocurrency wallets.Open source ↗. The incident demonstrates that the trust model of self-custody relies not only on robust cryptography but also on the physical integrity of devices throughout their distribution chain. Users must prioritize purchase-channel hygiene, because Ledger's standard authenticity check cannot detect implants that leave the Secure Element untouched [5].

Mechanism of Compromise and Technical Details

The vulnerability exploited in this incident was not a software bug or a cryptographic flaw, but a physical insertion of malicious components into legitimate hardware enclosures. Ledger confirmed that some devices sold by CryptoBilis contained a covert LTE cellular implant capable of transmitting wallet keys over a mobile network [6]kucoin.comLedger warns of LTE spy chips in devices sold by CryptoBilisLedger has detailed a security incident involving devices sold by a vendor identified as CryptoBilis, which allegedly contained covert components capable of transmitting cryptocurrency wallet keys over a mobile network.Open source ↗. The implant sat inside the device enclosure and utilized an embedded SIM (eSIM) to establish a data connection independent of user interaction or computer connectivity [4].

Ledger Donjon, the company’s security research team, detailed that the implants used microcontrollers to decode 24-word recovery phrases displayed during setup [2]cointelegraph.comLedger details LTE-enabled spy implants in wallets sold by CryptoBilisLedger Donjon found implants used microcontrollers to read 24-word setup phrases and send them over LTE, without compromising the device's Secure Element.Open source ↗. When a user initialized the device and the screen displayed the backup phrase, the implant’s microcontroller recognized and decoded the words [1]. The captured data was then transmitted over LTE networks to attackers [4]. This method effectively neutralizes the security benefit of hardware wallets, which are designed to keep private keys isolated from internet-connected devices [6]. By capturing the recovery phrase at the moment of display, the attacker gains the master key to recreate the wallet elsewhere without needing the physical device or changing any transactions on it [1].

Technical analysis provided by Tibane Labs identified specific components within the compromised units. Researchers found an ST STM32G431KBU6 microcontroller and a tiny 2x2 mm eSIM package next to the MCU, alongside a shielded LTE module [5]. In some variants, attackers replaced the original battery with a smaller one to power both the implant and the Ledger device, while in others, the malicious circuitry was fitted into the space normally occupied by foam padding under the OLED display [5]. The presence of antenna cables running along the top edge of the casing served as a telltale sign of tampering, although some advanced variants attempted to hide part numbers by scraping markings off the MCU and eSIM [5].

Scope of Impact and Financial Losses

The financial impact of this supply-chain attack is substantial, with on-chain researchers estimating losses of up to $93.2 million across more than 300 wallets, while investigator Specter said losses could exceed $86 million and Yfarmx put its estimate at $103 million [2]cointelegraph.comLedger details LTE-enabled spy implants in wallets sold by CryptoBilisLedger Donjon found implants used microcontrollers to read 24-word setup phrases and send them over LTE, without compromising the device's Secure Element.Open source ↗[4]. The Street reports the total drained amount as approximately $90 million, while Yahoo Finance cites a figure of $93 million [7]thestreet.comLedger spy chip scandal raises fears over crypto wallet securityIn an investigation update on X, Ledger said a spy chip inside devices sold by Southeast Asian reseller CryptoBilis read users' 24-word recovery phrases off the screen and sent them over a mobile network.Open source ↗[8]finance.yahoo.comHackers hid a spy chip in Ledger wallets to steal $93MLedger says covert hardware implanted in wallets sold by reseller CryptoBilis read users' recovery phrases off the screen and beamed them to attackers over a cellular network, stealing an estimated $93 million.Open source ↗. These estimates are derived from blockchain analysis rather than direct confirmation from Ledger, which has not released official data on the number of victims or the exact value stolen [5]. Tether, the issuer of the USDT stablecoin, froze $10 million of USDT tied to the theft [8].

The geographic scope of the compromise was primarily concentrated in Southeast Asia, where CryptoBilis operated as an authorized reseller in Indonesia, Malaysia, and the Philippines [2]. Ledger confirmed that every verified loss in the October 9 incident involved a device sold by CryptoBilis [1]. However, reports of tampered devices emerged beyond this region. A customer in Germany reported finding a spy implant in a unit purchased from MediaMarkt Saturn, leading the retailer to stop selling Ledger devices immediately [3]. Additionally, an X user named Johannes claimed to have found similar implants in two devices bought from separate MediaMarkt stores in Europe, though Ledger has not confirmed whether these European reports are linked to the CryptoBilis incident [2].

Mark Karpeles, former CEO of Mt. Gox, claimed he found a spy implant in a Ledger Flex bought at Singapore Airport [1]. Ledger did not confirm that this device was tied to the same incident [9]coincentral.comLedger Wallet Tampering: Sales Halted in Asia and Europe After Implant FoundMediaMarkt Saturn stopped selling Ledger devices in stores and online as of Oct. 13. Ledger asked resellers in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales.Open source ↗.

Industry Response and Supply-Chain Repercussions

The disclosure triggered immediate and widespread reactions across the hardware wallet industry. CryptoBilis suspended sales and shipments of all hardware wallet brands in Malaysia, the Philippines, and Indonesia, expanding an earlier halt limited to Ledger devices [2]. The reseller also temporarily closed its physical stores and stated it was reviewing its processes with independent specialists [2].

Competitors Trezor and OneKey severed ties with CryptoBilis as a precautionary measure. Trezor reported no reports of tampered Trezor devices sold through the reseller but removed CryptoBilis from its authorized reseller network entirely [2]. Furthermore, Trezor announced it would cut its wider network of authorized resellers, ending authorizations for many partners by January 1, 2027, to reduce supply-chain risk [10]decrypt.coTrezor Cuts Its Resellers After Ledger Finds Spy Implant in Crypto WalletsTrezor told partners their reseller authorization ends January 1, 2027, describing the cut as a preventive step taken out of caution following Ledger's supply-chain incident discovery.Open source ↗. OneKey similarly terminated CryptoBilis’ authorization and offered free replacements for devices purchased through the reseller between March 1 and October 12, 2026 [3].

MediaMarkt Saturn, a major European consumer electronics chain, stopped selling Ledger devices in its stores and online following a customer report of a spy implant found in Germany [9]coincentral.comLedger Wallet Tampering: Sales Halted in Asia and Europe After Implant FoundMediaMarkt Saturn stopped selling Ledger devices in stores and online as of Oct. 13. Ledger asked resellers in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales.Open source ↗. The retailer stated it takes the incident seriously and is in contact with the manufacturer to remove affected products [9]. This reaction underscores the reputational risk hardware wallet manufacturers face when their distribution channels are compromised, even if the breach originates from third-party resellers rather than the manufacturer itself.

Assessment of Security Implications and Recommendations

Ledger characterized the incident as a physical supply-chain attack rather than a breach of its software or internal systems [7]thestreet.comLedger spy chip scandal raises fears over crypto wallet securityIn an investigation update on X, Ledger said a spy chip inside devices sold by Southeast Asian reseller CryptoBilis read users' 24-word recovery phrases off the screen and sent them over a mobile network.Open source ↗. The company emphasized that the implant did not modify the device’s Secure Element, the chip designed to protect private keys, nor did it alter the operating system or transactions [1]. This distinction is critical for assessing the long-term security of Ledger devices. While the specific distribution channel was compromised, the underlying cryptographic architecture remains intact. Ledger says it has no sign that its own systems, services or direct sales channel were compromised, though it is still examining reports of implants in devices sold elsewhere [9]coincentral.comLedger Wallet Tampering: Sales Halted in Asia and Europe After Implant FoundMediaMarkt Saturn stopped selling Ledger devices in stores and online as of Oct. 13. Ledger asked resellers in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales.Open source ↗.

However, the incident highlights a persistent weakness in hardware wallet security: the reliance on physical integrity during distribution. Ledger’s Genuine Check mechanism, designed to verify device authenticity, explicitly warns that it cannot detect added implants when the original Secure Element remains untouched [5]. This limitation means that standard verification tools may fail to identify sophisticated physical tampering, necessitating user vigilance and stricter reseller controls [6].

Ledger advised users who purchased devices from CryptoBilis not to initialize unused units and to transfer assets to new devices with newly generated recovery phrases if they had already been set up [1]. The company also urged affected users to contact support and file police reports, while directing customers who bought devices elsewhere to an inspection guide warning that opening a device could damage it [2]. These recommendations reflect the severity of the compromise; once a recovery phrase is captured, the funds associated with that wallet are exposed, as an attacker can recreate the wallet on any new device without the original hardware [4].

The broader implication for the cryptocurrency ecosystem is a heightened awareness of supply-chain risks in self-custody solutions. The sophistication of the LTE-enabled implant suggests a deliberate, resourced effort to compromise cold storage devices [6]. Manufacturers and users alike must prioritize purchase-channel hygiene as a core component of security strategy. Buyers must source wallets directly from manufacturers or verified retail partners to reduce exposure to tampered hardware, as devices bought through third-party resellers carry heightened risk of having been opened, modified, and resealed before resale [6].

The Ledger CryptoBilis incident serves as a decisive judgment on the vulnerabilities inherent in distributed hardware distribution networks. While the cryptographic foundations of hardware wallets remain robust, their security is only as strong as the physical integrity of the devices during transit. Estimated losses of up to $93.2 million from LTE implants show that a physical supply-chain attack can capture a recovery phrase without touching the device's Secure Element, and that Ledger's standard authenticity check cannot detect such implants. Users and institutions must therefore treat hardware wallet distribution with the same rigor applied to physical security protocols, recognizing that trust in self-custody depends fundamentally on the unbroken chain of custody from manufacturer to end user. The industry's response included Trezor's reseller network reduction and MediaMarkt Saturn's sales halt, while Ledger said it is reviewing its reseller controls and anti-tamper protections [1]coindesk.comLedger finds covert cellular implant stole hardware wallet recovery phrases from screensLedger said an unauthorized implant in some devices sold by Southeast Asian reseller CryptoBilis captured users' 24-word recovery phrases from the screen and transmitted them over a mobile network.Open source ↗[9]coincentral.comLedger Wallet Tampering: Sales Halted in Asia and Europe After Implant FoundMediaMarkt Saturn stopped selling Ledger devices in stores and online as of Oct. 13. Ledger asked resellers in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales.Open source ↗[10].