Ledger has identified malicious implants embedded in its hardware wallets sold by CryptoBilis, an authorized reseller in Indonesia, Malaysia, and the Philippines. The French wallet maker's security research team, Ledger Donjon, found that the implants used a microcontroller to capture users' 24-word recovery phrases displayed during setup and transmit the data over cellular networks using an embedded SIM (eSIM).
According to Ledger, the implants did not compromise the devices' security chips or alter transactions. The company confirmed Saturday that at least one affected device contained an unauthorized implant.
The incident came to light Friday after cryptocurrency losses were reported involving Ledger devices purchased through CryptoBilis. Blockchain investigator Specter estimated losses could exceed $86 million, while cybersecurity outlet Yfarmx raised its estimate to $103 million. Ledger has not confirmed a total loss figure.
Ledger urged users who suspect tampering to contact its support team and file a police report. The company provided an inspection guide for customers who purchased devices elsewhere, warning that opening a device could cause damage and advising users to back up their recovery phrases first.
Although confirmed losses have involved CryptoBilis sales, Ledger said it is examining reports beyond the reseller. An X user reported finding implants in two Ledger devices purchased from separate MediaMarkt stores in Europe, though Ledger has not confirmed whether these reports are connected to the CryptoBilis incident.
CryptoBilis suspended sales and shipments of all hardware wallet brands across Malaysia, the Philippines, and Indonesia on Saturday, expanding an earlier halt limited to Ledger devices. The reseller also temporarily closed its physical stores and said it was reviewing its processes with independent specialists.
Trezor and OneKey, competing hardware wallet providers, removed CryptoBilis from their authorized reseller networks. Trezor reported no confirmed cases of tampering with its devices sold through CryptoBilis. OneKey reported no related user losses and offered free replacements for devices purchased from CryptoBilis between March 1 and October 12, 2026, with applications accepted through December 31.
