Ledger’s security research team, Ledger Donjon, identified malicious LTE-enabled implants in hardware wallets sold by CryptoBilis, an authorized reseller in Indonesia, Malaysia, and the Philippines. The implants utilized a microcontroller to decode 24-word recovery phrases displayed on device screens during setup and transmitted this data over cellular networks via an embedded SIM (eSIM). Ledger stated that these devices did not compromise the internal security chips or alter transaction logic directly.
The incident emerged after users reported significant crypto losses linked to Ledger devices purchased through CryptoBilis. While blockchain investigator Specter estimated potential losses exceeding $86 million and cybersecurity outlet Yfarmx raised its estimate to $103 million, Ledger has not confirmed the total financial impact. In response, CryptoBilis suspended sales and shipments of all hardware wallet brands across the three affected countries and temporarily closed its physical stores to review processes with independent specialists.
Separately, reports surfaced regarding similar implants found in Ledger devices purchased from MediaMarkt, a European consumer electronics chain. Ledger has not yet confirmed if these European incidents are connected to the CryptoBilis supply chain issue. Other manufacturers have reacted to the breach: Trezor removed CryptoBilis from its authorized network despite finding no tampered devices, while OneKey terminated CryptoBilis’ authorization and offered free replacements for devices purchased between March 1 and October 12, 2026.
This development exposes a critical vulnerability in the physical supply chain of self-custody solutions, demonstrating that even air-gapped devices can be compromised at the point of sale. The use of LTE-enabled implants to exfiltrate recovery phrases bypasses traditional software-based security measures, shifting the attack vector from digital exploitation to hardware tampering. This undermines the core value proposition of hardware wallets, which rely on the assumption that the device remains untampered from factory to user.
The immediate implication is a heightened scrutiny of authorized reseller networks and distribution channels. As other vendors like Trezor and OneKey sever ties with CryptoBilis, the industry faces increased operational risk regarding third-party logistics. Users must now consider physical inspection protocols as part of their security hygiene, though such actions may void warranties or damage devices. This incident highlights the tension between convenience in purchasing hardware and the rigorous verification required to maintain true self-custody integrity.
