The crypto industry's worst nightmare about hardware wallets has turned out to be real. Ledger's in-house security team, Donjon, confirmed on Tuesday that devices sold through CryptoBilis, a third-party reseller in Southeast Asia, were fitted with a hidden implant that quietly captured users' 24-word recovery phrases and sent them out over a mobile data connection.
According to Ledger, the implant watches the device's screen during setup, decodes the seed words when they appear, and transmits them over LTE using a built-in eSIM. Crucially, it does not touch the Secure Element chip or Ledger's operating system, and it doesn't change transactions or signatures. That means a tampered wallet would look and behave completely normally while its owner's master key was already in someone else's hands.
The financial damage could be significant. Onchain investigators have estimated suspected thefts at more than $86 million across Bitcoin, Ethereum and Tron wallets. Ledger has been careful to say it has not verified that figure, nor the number of people affected, and it has urged victims to work with law enforcement before opening their devices. The company also stressed it has seen no sign that its own systems or services were breached.
The fallout spread quickly. Ledger asked CryptoBilis to stop all sales and shipments, and later asked resellers across Southeast Asia and Hong Kong to pull devices from shelves while investigators work out where the tampering took place. In Europe, electronics chain MediaMarkt Saturn suspended Ledger sales in stores and online from October 13 after a customer in Germany reported finding an implant. No funds were lost in that case, according to Ledger. Separately, former Mt. Gox CEO Mark Karpelès said a Ledger Flex he bought at Singapore's airport also contained a spy device, though Ledger hasn't confirmed a link to the same incident.
Rival Trezor moved fast, too. The company says there is no evidence any of its devices were compromised, but it has dropped CryptoBilis and is now shrinking its wider reseller network as a precaution. Chief Commercial Officer Danny Sanders told affected partners that their authorization will end on January 1, 2027. They won't receive new stock, but can sell what they already have through the holiday season. Resellers that stay will face stricter rules on sourcing, storage and handling. OneKey has also cut ties with CryptoBilis and is offering free replacements for devices bought through it between March 1 and October 13.
For everyday users, the advice from manufacturers is consistent: buy directly from the official store whenever possible. Ledger has told anyone who bought from CryptoBilis in the last 90 days not to set up their device, and those who already did should move funds to a new seed phrase generated on a device bought directly from Ledger.
The episode lands at a delicate moment for crypto markets, with Bitcoin hovering in the low $80,000s and sentiment already fragile. While the incident doesn't point to any weakness in the underlying cryptography, it exposes how much self-custody security depends on a clean supply chain, and it's likely to push more buyers toward direct-from-manufacturer purchases going forward.