Ledger Exposes LTE Spy Implants in Hardware Wallets Sold by CryptoBilis

Ledger’s security research team has uncovered how malicious implants in wallets sold through reseller CryptoBilis stole user funds. According to a Tuesday post, the implants used a microcontroller to read 24-word recovery phrases directly off device screens, then transmitted the data over cellular networks via an embedded SIM. The security chips stayed untouched, and transactions were never altered.

$86 Million in Suspected Crypto Losses

The issue surfaced Friday after users reported losses from Ledger devices bought via CryptoBilis, an authorized reseller in Indonesia, Malaysia and the Philippines. Investigators estimate damages could exceed $86 million, with some projections reaching $103 million, though Ledger hasn’t confirmed a total.

Possible Implant Cases Beyond CryptoBilis

Ledger is now examining reports beyond the reseller, including unverified claims from a European buyer who said he found implants in two devices purchased from separate MediaMarkt stores.

CryptoBilis Suspends Sales as Partners Withdraw

CryptoBilis has halted all hardware wallet sales and shipments across its three markets and closed its physical stores for review. Trezor found no evidence its devices were affected but still dropped the reseller. OneKey reported no user losses, terminated CryptoBilis’s authorization, and offered free replacements for devices bought between March 1 and October 12.