Ledger Detects LTE Implant in CryptoBilis Wallets That Steals Recovery Phrases

Trezor announced it would reduce its number of resellers as a "preventive step, taken out of an abundance of caution," following reports of malicious implants in competitor Ledger devices. Trezor stated there is "not a single piece of evidence that [its] devices have been compromised," but CCO Danny Sanders confirmed notifying certain resellers for removal from authorized lists on Jan. 1 and halting shipments starting Tuesday, citing "recent supply-chain incidents." This follows Ledger confirming at least one device from a Southeast Asian reseller, CryptoBilis, contained an unauthorized hardware implant that exposed recovery phrases, potentially leading to $72 million to $86 million in user losses.

Trezor announced the termination of reseller authorizations, effective January 1, 2027, stating there is no evidence its devices were compromised. This follows Ledger's Donjon team finding a spy implant in wallets sold by Southeast Asian reseller CryptoBilis, which captures recovery phrases from the screen and transmits them over LTE. Onchain investigator Specter traced over $86 million in suspected thefts, a figure Ledger has not verified. Trezor described the move as a preventive step to strengthen supply chain vetting.

Trezor has reduced the number of resellers it works with as a preventive measure following supply-chain incidents involving its competitor Ledger. Trezor stated there is no evidence its devices have been compromised. Ledger confirmed that devices sold through Malaysia-based reseller CryptoBilis were linked to lost funds, including one instance of an unauthorized hardware implant capable of reading a seedphrase, though Ledger has not verified the total loss, which blockchain investigator Specter estimated at $86 million. CryptoBilis has stopped sales.

Ledger confirmed a hardware implant in devices sold by CryptoBilis steals recovery phrases, leading MediaMarkt to suspend sales in Europe.

Ledger's Donjon security team found an unauthorized LTE implant in wallets sold by CryptoBilis, potentially exposing over $86 million in assets. The implant captures recovery phrases during setup and transmits them via LTE. Ledger advises users to migrate assets to new devices and not to use any recovery phrases from CryptoBilis wallets.

Ledger stated in a 72-hour update that all confirmed cases in last week's wallet-draining incident involve devices sold by Southeast Asian reseller CryptoBilis, while its own systems and direct sales channels remain unaffected. Ledger confirmed the volume of impacted devices is limited, is working with relevant authorities, and urged buyers to avoid unauthorized sellers, while CryptoBilis has ceased all hardware wallet sales. Onchain investigator Specter traced more than $86 million in suspected thefts across Ethereum, Tron, and Bitcoin.