Ledger confirms recovery-phrase implant in a wallet bought from reseller CryptoBilis

Ledger's security research team says it has found an unauthorized hardware implant, built to capture wallet recovery phrases, inside a device sold by the Southeast Asian reseller CryptoBilis, according to a post from the Paris-based manufacturer on Tuesday (Oct. 27) reported by Decrypt.

Per Decrypt's account of Ledger's statements, the company first disclosed the incident on Friday, Oct. 23, and confirmed the implant in one affected user's device the following day, Saturday, Oct. 24. Every loss Ledger has confirmed so far involves hardware purchased through CryptoBilis; the company said it had not verified a drain tied to a device bought through its official channels. Decrypt characterized the component as an "LTE implant" — i.e. one with cellular connectivity to exfiltrate the stolen seed phrases — and put suspected total losses at roughly $86 million.

Decrypt's headline also states that Trezor has warned CryptoBilis buyers after a report of a hardware implant in one of its Safe 5 devices. The confirmed technical detail here, though, traces to Ledger; what Trezor independently found or confirmed is not spelled out in the available account.

Key facts

• Ledger says it found a recovery-phrase-capturing hardware implant in a device sold by reseller CryptoBilis (Ledger, via Decrypt).
• Disclosed Friday, Oct. 23; implant confirmed in one user's device Saturday, Oct. 24; public post Tuesday, Oct. 27 (Decrypt, citing Ledger).
• All confirmed losses involve CryptoBilis-sold hardware; no verified drain tied to officially sourced devices (Ledger, via Decrypt).
• Suspected total losses of ~$86M; described as an "LTE" cellular implant (Decrypt).
• Decrypt's headline says Trezor separately warned CryptoBilis buyers over an implant reported in a Safe 5 (Decrypt).

The real-world read

Start with what this is: a reseller supply-chain compromise, not a break in Ledger's or Trezor's own manufacturing. The common thread is CryptoBilis, a third-party seller — the manufacturers' message is that devices bought through unofficial channels can be physically tampered with before they reach you. That's the honest framing, not "hardware wallets are hacked."

Treat the $86 million as what it is: a suspected figure, not a confirmed one. Ledger itself says it has verified the implant in a single device and has not tied broader drains to officially sourced hardware — the large headline number is doing more work than the confirmed facts support. We'd want an on-chain accounting before repeating it as settled.

One genuine discrepancy: the reporting names both Trezor (a Safe 5 device, from Prague's SatoshiLabs) and Ledger (Paris) as affected via the same reseller, but the only confirmed implant analysis described comes from Ledger. Whether a Trezor device was independently confirmed compromised, or whether the two got conflated, isn't resolved in the account here. This rests on a single secondary source; corroborating statements directly from each manufacturer would firm it up.

If you own a device bought from a reseller, the vendors' standard guidance applies — verify authenticity through official tools and move funds to a known-genuine device. That's not a trade call.

Opinion, and whose

Ledger's position, via Decrypt, is that the risk is isolated to CryptoBilis-sold units and not its official supply chain — a claim from an interested party protecting its brand, and one to weigh accordingly. The $86M loss estimate is attributed to Decrypt's reporting, not to confirmed on-chain figures.

Sources

• Decrypt (secondary) — reported Ledger's statements, the disclosure timeline, the "LTE implant" description, the ~$86M suspected-loss figure, and the Trezor Safe 5 warning. No marketing or sponsored content noted; some claims trace to Ledger's own posts (an interested party).

This is news reporting, not financial or security advice.