Ledger probes wallet tampering after LTE-enabled implants found in devices sold by CryptoBilis

Traders Union
All News
Crypto
Ledger wallet tampering probe

Highlights

Ledger uncovers LTE-enabled microcontroller implants in devices sold by CryptoBilis, exposing recovery phrases without compromising secure chips or altering transactions.
Blockchain investigator Specter estimates crypto losses could exceed $86 million, with Yfarmx reporting up to $103 million, after reports of tampered Ledger devices in Southeast Asia.
CryptoBilis suspends all hardware wallet sales and closes stores across Malaysia, the Philippines and Indonesia, while Trezor and OneKey drop CryptoBilis from their reseller networks.

Ledger details implant method and expanding review

As reported by Cointelegraph, citing Ledger in a Tuesday post on X, its Ledger Donjon security team found that the implants use a microcontroller to decode the 24-word recovery phrases shown on device screens and then transmit that data over LTE networks through an embedded SIM, or eSIM.

Ledger says the implants do not compromise the wallets’ secure chips or alter transactions. The issue emerges Friday after crypto losses are reported involving Ledger devices sold through CryptoBilis, an authorized reseller in Indonesia, Malaysia and the Philippines, and the company confirms Saturday that one affected device contains an unauthorized implant.

Blockchain investigator Specter says losses could exceed $86 million, while cybersecurity outlet Yfarmx puts its own estimate at $103 million. Ledger has not confirmed a total and says it has sold more than 8 million hardware wallets, which store private keys offline and require transactions to be approved on the device.

Reseller fallout spreads across hardware wallet market

Ledger urges users who suspect tampering to contact its support team and file a police report. The company also directs customers who bought devices elsewhere to an inspection guide that warns opening a device could damage it and advises users to back up recovery phrases first.

Although confirmed losses so far involve devices sold by CryptoBilis, Ledger says it is examining reports beyond that reseller. Separately, X user Johannes posts photos of two Ledger devices he says he bought from separate MediaMarkt stores in Europe and says he found implants in both, though Ledger has not confirmed whether those reports are linked to the CryptoBilis case.

CryptoBilis says in a Saturday X post that it has suspended sales and shipments of all hardware wallet brands across Malaysia, the Philippines and Indonesia, expanding an earlier halt that only covered Ledger devices. The reseller also temporarily closes its physical stores and says it is reviewing its processes with independent specialists.

Trezor says Monday that it receives no reports of tampered Trezor devices sold through CryptoBilis and finds no indication its products are affected, but it removes CryptoBilis from its authorized reseller network. OneKey also reports no related user losses, terminates CryptoBilis' reseller authorization, suspends onboarding new resellers and starts reviewing its distribution network, while offering free replacements for devices bought from CryptoBilis between March 1 and Oct. 12, 2026, with applications open through Dec. 31.

Our earlier coverage on Malaysia’s tech and infrastructure outlook highlighted how investor attention is concentrating around semiconductors, power infrastructure and data centre expansion, alongside growing concerns about execution risks such as talent shortages and stretched valuations. We also noted that rising data centre build-out is putting utilities under scrutiny, prompting authorities to reassess electricity and water demand claims and consider how operators may need to secure supply via options like solar or battery storage.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.