Ledger confirms seed-stealing implant in CryptoBilis-sold signers; MediaMarkt pulls devices in Europe

Ledger's Donjon security team said Tuesday it has confirmed that hardware signers sold by Southeast Asian reseller CryptoBilis were fitted with an unauthorized implant that captures the 24-word recovery phrase as users set the device up, then transmits it over LTE using a provisioned eSIM, according to a Donjon post on X reported by The Block.

Crucially, Ledger says the implant does not touch the device's Secure Element or operating system, and does not alter transactions or signatures. The theft happens by reading the seed words off the screen during initialization — not by breaking the wallet's cryptography. Ledger advised anyone who lost funds to coordinate with law enforcement before opening the signer, and asked CryptoBilis to pause all sales and shipments while it examines recovered hardware.

The confirmation follows Ledger's disclosure last week that it was investigating fund losses tied to CryptoBilis purchases. On-chain researchers put losses at more than $86 million across Bitcoin, Ethereum and Tron — but Ledger says that figure comes from third parties and remains unverified, as does the number of users affected.

The fallout is spreading through retail and rival makers. MediaMarkt Saturn stopped selling Ledger devices in stores and online as of Oct. 13 after a single customer in Germany reported a tampered unit; no funds were lost in that case, per Ledger. A MediaMarktSaturn spokesperson told The Block the group "removed all of the manufacturer's affected products" and is in contact with Ledger.

Key facts

• Ledger's Donjon confirmed (Tuesday, X) the implant reads the 24-word phrase at setup and sends it over LTE via eSIM; Secure Element and OS unaffected. (Source: Donjon/X via The Block)
• On-chain researchers estimate losses above $86M in BTC, ETH and Tron; Ledger calls this unverified. (The Block)
• MediaMarkt Saturn suspended Ledger sales across Europe on Oct. 13 after one German report; no funds lost. (MediaMarkt spokesperson via The Block)
• Trezor says no evidence its devices were compromised but dropped CryptoBilis and will deauthorize cut resellers on Jan. 1, 2027. (Letter from CCO Danny Sanders via The Block)
• OneKey revoked CryptoBilis and is offering free replacements for units bought through it between March 1 and Oct. 13. (The Block)

The real-world read

Note what Ledger is careful to stress: its "infrastructure, systems, or services" weren't compromised, and nor was the Secure Element. That's accurate — and it also steers attention away from the actual failure point, which is the reseller supply chain Ledger authorizes. The attack doesn't need to beat the chip; it reads your seed off the screen.

Treat the $86 million as an unverified third-party estimate, not a confirmed loss. Two other reports — an X user named Johannes who says he found cellular modules in two MediaMarkt-bought devices, and ex-Mt. Gox CEO Mark Karpelès's claim of an implant in a Ledger Flex bought at Singapore's airport — are unverified, and Ledger declined to link the Singapore device to the CryptoBilis case. Rivals' moves read as reputational defense as much as safety: Trezor and OneKey both say they've seen no evidence of compromise in their own products while tightening reseller lists "out of an abundance of caution."

Not financial advice. If you bought a signer from a reseller, verify your device per the manufacturer's guidance and consult law enforcement before opening a suspected unit.