Ledger finds LTE implants in CryptoBilis-sold wallets

Ledger says hidden LTE-enabled implants in devices sold through Southeast Asian reseller CryptoBilis captured users’ 24-word recovery phrases during setup, turning a hardware wallet’s initialisation into a route for stealing funds. The company’s security team found a microcontroller that read the phrase displayed on the device screen and transmitted it using an embedded SIM, according to Cointelegraph’s report on Ledger Donjon’s findings.

The distinction matters: Ledger said the implants did not alter transactions or compromise the devices’ Secure Element or operating system. The recovery phrase itself, however, can restore access to the wallet elsewhere. Anyone who captures it may therefore control the associated assets without defeating the device’s normal signing process.

How did the implants get around the wallet’s protections?

The implant operated alongside the wallet’s existing components. It read the words shown on the screen during setup, then sent them over LTE through an eSIM. That approach targeted the moment a new user creates or verifies a recovery phrase, rather than changing how the wallet signs later transactions.

Ledger’s October 15 account says genuine devices were opened, fitted with hidden components and returned to distribution through resellers in Southeast Asia. The company says its systems, chip and operating system were not compromised; it describes the incident as an attack on distribution after devices left its control. Ledger has not published a full technical disclosure, saying it plans to share more details later. Its response to the hardware implant attack also says samples it screened from its own stock and from examined stores and warehouses were clean.

That account points to a different exposure from a software flaw: a device can pass through normal channels looking genuine while carrying an added component. Ledger’s response says resellers must stop putting devices on shelves or displays and keep stock in the back until purchase. It also reminded distributors that returned devices must never be resold, even if they appear unopened.

What is known about the losses and affected devices?

Ledger’s confirmed theft reports so far involve devices sold through CryptoBilis, but the company has not confirmed the total value lost or how many customers were affected. The funds were drained on October 9, according to Ledger, and the company says it is reviewing reports involving other sellers and locations. That leaves the scale and geographic reach unresolved.

CryptoBilis was listed as an authorized Ledger reseller in Indonesia, Malaysia and the Philippines. The company said it suspended sales and shipments of hardware wallets while cooperating with Ledger’s investigation. The incident therefore puts pressure on the distinction between buying from a manufacturer directly and buying through an authorized reseller: reseller status establishes a commercial relationship, but it did not prevent the tampering Ledger describes.

For comparison, Ledger says the devices it examined from its own stock and stores were clean. That is a limited finding, not proof that every device sold elsewhere is unaffected. Ledger has also asked resellers and distributors in Southeast Asia and Hong Kong to suspend sales while it investigates, and says it is working with law enforcement and security researchers.

What should CryptoBilis buyers do, and what comes next?

Ledger advises buyers who have not set up a CryptoBilis device not to initialise it and to contact support. Those who have already used one should move their assets to a new signer with a newly generated recovery phrase. The company also warns against entering or restoring a recovery phrase on a CryptoBilis-purchased device.

The next signals are Ledger’s promised technical disclosure, the results of its wider review of reports beyond CryptoBilis, and any confirmed accounting of losses. Its new reseller controls may reduce the risk of returned or displayed stock being passed on as new, while the investigation will need to establish whether the implants were confined to the distribution route Ledger has identified.

Sources and documents

• Cointelegraph’s report on Ledger Donjon’s findings — cointelegraph.com
• response to the hardware implant attack — ledger.com