USD
Ledger Confirms Recovery-Phrase Implant in CryptoBilis-Sold Wallets
MediaMarkt halts sales as Trezor and OneKey tighten reseller controls
TL;DR
- Ledger confirmed an unauthorized hardware implant in devices sold by CryptoBilis that captures recovery phrases and sends them over LTE.
- MediaMarkt Saturn stopped selling Ledger devices after a German customer reported a tampered unit.
- Trezor is reducing its reseller network, while OneKey revoked CryptoBilis and offered replacement devices.
Trade smarter on Jupiter, Solana’s leading DEX built for fast execution and deep liquidity.
Swap tokens at competitive rates, route across multiple liquidity sources automatically, and access perpetuals, DCA, and advanced trading tools — all in one place!
Ledger has confirmed that an unauthorized hardware implant inside signers sold by Southeast Asian reseller CryptoBilis can capture a user’s 24-word recovery phrase during setup and transmit it over LTE through a provisioned eSIM. Ledger said the implant does not modify its Secure Element, operating system, transactions or signatures.
Ledger’s Donjon security team said the implant sits inside the device enclosure and reads information displayed on the screen. When the recovery phrase appears during setup, its microcontroller decodes the words and sends them through the cellular connection. Anyone who obtains that phrase can restore the wallet and gain control of its funds.
Ledger said it confirmed the implant on October 10 in one affected user’s signer. All confirmed losses tied to the investigation involved devices sold through CryptoBilis, and Ledger said it had not verified a drain connected to a device bought elsewhere.
Ledger has not verified either total or confirmed how many users were affected.
“Figures circulating online come from third parties and Ledger has not fully verified them,” the company said. “If you lost funds, coordinate with law enforcement before opening the signer.”
Ledger also said it had no indication that its infrastructure, systems or services had been compromised.
CryptoBilis stopped selling Ledger devices while the investigation continued. Ledger also asked the reseller to pause sales and shipments as its cybersecurity team examined recovered hardware.
MediaMarkt suspends Ledger sales in Europe
MediaMarkt Saturn stopped selling Ledger devices both online and in stores on October 13 after a customer in Germany reported an implant. Ledger said no funds were lost in that case.
“We take this incident very seriously,” a MediaMarkt Saturn spokesperson said. “The MediaMarktSaturn Retail Group has removed all of the manufacturer's affected products from its stores and online platforms and is in contact with the manufacturer.”
An X user known as Johannes said he bought two Ledger devices from separate MediaMarkt stores and found unauthorized cables and cellular modules inside both. The claims have not been independently verified.
Former Mt. Gox CEO Mark Karpelès separately said a Ledger Flex purchased at Singapore’s airport contained a spy implant, though Ledger did not confirm that device was connected to the same incident.
Trezor cuts reseller network as precaution
Trezor responded by tightening its own distribution network. The company said it had no reports of tampered Trezor devices from CryptoBilis and no indication that its products were affected, but removed the reseller from its authorized list as a precaution.
Trezor is also reducing its broader reseller network. Chief Commercial Officer Danny Sanders told partners that affected resellers will lose authorization on January 1, 2027. Trezor has stopped supplying them with new stock, although they can continue selling remaining inventory through Black Friday and the holiday period.
“There is not a single piece of evidence that Trezor devices have been compromised,” Sanders wrote. “This is a preventive step, taken out of an abundance of caution.”
Sanders said each country was assessed based on revenue, distribution and Trezor’s own reach. Resellers that remain authorized will face an updated legal framework and closer checks covering how devices are sourced, stored and handled.
OneKey also tightened its reseller controls. The company said it had recorded no customer fund losses linked to the incident, revoked CryptoBilis’ authorization and began reviewing its broader reseller network. Sellers operating under questionable legal entities will lose authorization.
OneKey is offering free replacements for devices purchased through CryptoBilis between March 1 and October 13, regardless of model or activation status.
This article has been refined and enhanced by ChatGPT.
