By Tom Whitfield

Malicious implants inside Ledger hardware wallets sold by reseller CryptoBilis captured users' 24-word recovery phrases and transmitted them over LTE cellular networks, Ledger confirmed on Tuesday. Estimated user losses now range from $86 million to $103 million, and the French device maker has not verified a final figure.

Ledger Donjon, the company's security research unit, found that each implant used a microcontroller to decode recovery phrases displayed on the device screen during setup, then exfiltrated the data through an embedded SIM (eSIM) over a cellular connection, according to a Tuesday post on X. The implants did not compromise the devices' secure chips and did not alter transactions, Ledger said.

The incident surfaced on Friday, after crypto users reported losses tied to Ledger devices purchased through CryptoBilis, a reseller listed as authorized in Indonesia, Malaysia and the Philippines. On Saturday, Ledger confirmed that at least one affected device contained an unauthorized hardware implant.

How large are the losses?

Blockchain investigator Specter estimated that losses could exceed $86 million. Cybersecurity outlet Yfarmx raised its own estimate to $103 million. Ledger has not confirmed either figure.

For scale, Ledger has sold more than 8 million hardware wallets worldwide. The devices store private keys offline and require users to approve transactions on the device itself — a security model that the screen-scraping implants bypassed by targeting the recovery phrase at the point of setup rather than attacking keys in transit.

The attack vector carries specific operational consequences. Because the implants read the 24-word phrase displayed during initialization, affected users exposed full wallet control even though transactions and secure elements remained untouched. Ledger urged users who suspect tampering to contact its support team and file a police report.

Are devices sold outside CryptoBilis affected?

Confirmed losses so far involve only devices sold by CryptoBilis, but Ledger said it is examining reports that extend beyond the reseller.

An X user named Johannes posted photos of two Ledger devices he said he bought from separate stores of MediaMarkt, a European consumer electronics chain. He said he found implants in both. Ledger has not confirmed whether the European reports connect to the CryptoBilis incident.

For customers who bought devices elsewhere, Ledger pointed to an inspection guide. The guide warns that opening a device can damage it and advises users to back up their recovery phrases before any inspection.

What have the reseller's partners done?

CryptoBilis said in a Saturday post on X that it had suspended sales and shipments of all hardware wallet brands across Malaysia, the Philippines and Indonesia, expanding an earlier halt that covered only Ledger devices. The reseller has also temporarily closed its physical stores and said independent specialists are reviewing its processes.

Trezor said Monday it had received no reports of tampered Trezor devices sold through CryptoBilis and found no indication its products were affected. It still removed CryptoBilis from its authorized reseller network.

OneKey reported no related user losses but terminated CryptoBilis' reseller authorization as well. It also suspended onboarding of new resellers and began a review of its existing distribution network.

OneKey offered free replacements for devices purchased from CryptoBilis between March 1 and Oct. 12, 2026. Customers can apply for replacements through Dec. 31.

The unbundling of CryptoBilis from three major vendors' authorized channels in under a week signals how quickly distribution trust can collapse after a physical supply-chain compromise. Ledger's review of reports beyond the reseller, including the unverified MediaMarkt claims, will determine whether the incident stays contained to Southeast Asian retail or widens into a global distribution problem.