#Trezor

Hidden LTE implants in Ledger wallets sold by reseller CryptoBilis stole recovery phrases

Ledger devices sold through CryptoBilis, a reseller listed as authorized in Indonesia, Malaysia and the Philippines, contained hidden hardware implants that captured users' 24-word recovery phrases, Ledger said in October 2026. Its Donjon security team found the implant sits inside the enclosure, reads the phrase off the screen during setup and sends it out over LTE using an embedded eSIM. It does not modify the Secure Element, the Ledger OS, transactions or signatures, so tampered devices may still pass authenticity checks. Wallets were drained on Oct 9; Ledger has not confirmed total losses, while on-chain investigator Specter traced more than $86 million in suspected thefts. Ledger calls it a physical supply-chain attack, not a breach of its software or systems, and says its direct sales channels are unaffected. On Oct 28 the Singapore Police Force said at least two cases since Sept 10 involved tampered Ledger wallets bought from some retail stores in Singapore, with about S$3.5 million (US$2.7 million) lost. On Oct 30 Trezor said it received a credible report of a similar implant (an extra board with a cellular module and antenna) in a Trezor Safe 5 bought from CryptoBilis; it has not examined the device yet and has no reports of lost funds, and it tells anyone who bought a Trezor from CryptoBilis since March 2026 to move funds to a new wallet with a new seed.

Ledger hardware wallets (signers) sold by reseller CryptoBilis, plus a reported Trezor Safe 5·Since Oct 9, 2026·updated Oct 30, 2026, 08:24 UTC