Ledger Reveals Cellular-Connected Surveillance Devices Hidden in CryptoBilis Hardware Wallets
The hardware wallet manufacturer Ledger disclosed technical specifications of cellular-enabled surveillance components that compromised seed phrases, prompting CryptoBilis to suspend operations while Trezor and OneKey severed reseller relationships.
Hardware wallet manufacturer Ledger revealed that malicious surveillance components hidden inside wallets distributed by CryptoBilis intercepted users' seed phrases from the devices' displays and sent them via cellular networks, according to the French company's disclosure.
The security research division at Ledger, known as Ledger Donjon, discovered that these surveillance components utilized a microcontroller to capture and decode the 24-word recovery phrases shown on screens during the initial setup process, with the information then sent over LTE cellular networks through an embedded SIM card (eSIM), Ledger stated in a Tuesday post on X.
According to Ledger's findings, the surveillance components did not breach the devices' secure element chips or modify transaction data.
The security breach came to light on Friday following reports of cryptocurrency thefts linked to Ledger hardware wallets purchased through CryptoBilis, a distribution partner recognized as an authorized reseller operating in Indonesia, Malaysia and the Philippines.
On Saturday, Ledger verified that an unauthorized surveillance component was discovered inside one compromised device. Blockchain security researcher Specter estimated that financial losses might surpass $86 million, whereas cybersecurity publication Yfarmx provided its own assessment of $103 million. Ledger has not yet validated the complete loss figure.
According to the company, Ledger has distributed over 8 million hardware wallets globally, which are devices designed to store users' private cryptographic keys in an offline environment and enable them to authorize transactions directly on the device.
Ledger Investigates Potential Implants Outside CryptoBilis Distribution Network
The company advised users who have reason to believe their devices may have been tampered with to reach out to its customer support division and submit a report to local law enforcement authorities.
For concerned customers who purchased their devices from other distribution channels, Ledger provided an inspection guide, which cautions that attempting to open a device carries the risk of physical damage and recommends that users create secure backups of their recovery phrases before proceeding.
While confirmed theft incidents to date have been connected to devices distributed through CryptoBilis, Ledger indicated it is investigating additional reports that extend beyond this particular reseller.
In a separate development, an X platform user identified as Johannes shared photographs of two Ledger devices that he claimed to have purchased from different retail locations of MediaMarkt, a major consumer electronics retail chain operating throughout Europe. According to his statement, he discovered surveillance implants in both units. Ledger has not yet verified whether these European incidents are connected to the CryptoBilis situation.
CryptoBilis Suspends All Hardware Wallet Distribution While Trezor, OneKey Terminate Partnerships
In an X post published on Saturday, CryptoBilis announced it had halted sales and shipping operations for all hardware wallet product lines throughout Malaysia, the Philippines and Indonesia, broadening an initial suspension that had been restricted exclusively to Ledger products.
The distribution company also announced the temporary closure of its brick-and-mortar retail locations and stated it was conducting a comprehensive review of its operational procedures with the assistance of independent security experts.
On Monday, Trezor announced that it had not received any reports concerning tampered Trezor devices distributed via CryptoBilis and discovered no evidence suggesting that its hardware products had been compromised. Despite this, the company proceeded to remove CryptoBilis from its official authorized reseller network.
OneKey similarly reported no user losses connected to this incident, but proceeded to terminate CryptoBilis' status as an authorized reseller. The company also put a hold on accepting new reseller applications and initiated a comprehensive audit of its current distribution partner network. OneKey announced it would provide complimentary replacement units for all OneKey devices acquired from CryptoBilis during the period spanning March 1 through Oct. 12, 2026, with customers permitted to submit replacement requests until Dec. 31.