Ledger Warns of LTE-Enabled Spy Implants in CryptoBilis Wallets

Background

Ledger, the French hardware wallet maker, has detailed the discovery of LTE-enabled spy implants in some of its wallets sold by reseller CryptoBilis. The implants, which were found to capture users' recovery phrases from device screens and transmit the data over cellular networks, were discovered by Ledger Donjon, the company's security research team. The incident surfaced after reports of crypto losses involving Ledger devices sold through CryptoBilis.

##

Ledger has since halted sales and severed ties with CryptoBilis, while other wallet manufacturers Trezor and OneKey have also suspended their dealings with the reseller. Ledger has urged users who suspect tampering to contact its support team and file a police report. The company has also directed concerned customers who bought devices elsewhere to an inspection guide, which warns that opening a device could damage it and advises users to back up their recovery phrases first.

##

CryptoBilis has suspended sales and shipments of all hardware wallet brands across Malaysia, the Philippines, and Indonesia, and has temporarily closed its physical stores. The reseller has also said it is reviewing its processes with independent specialists. Trezor and OneKey have removed CryptoBilis from their authorized reseller networks and have suspended onboarding new resellers. The companies have also offered free replacements for affected devices.

##

Ledger has sold over 8 million hardware wallets, devices that keep users' private keys offline and let them approve transactions on-device. The company has confirmed that the implants did not compromise the devices' security chips or alter transactions. Blockchain investigator Specter has estimated that losses could exceed $86 million, while cybersecurity outlet Yfarmx has raised its own estimate to $103 million. Ledger has not confirmed the total.

##

Ledger has urged users to contact its support team and file a police report if they suspect tampering. The company has also directed concerned customers who bought devices elsewhere to an inspection guide, which warns that opening a device could damage it and advises users to back up their recovery phrases first.

##

In related news, X user Johannes posted photos of two Ledger devices he said he bought from separate stores of MediaMarkt, a European consumer electronics chain. He said he found implants in both devices. Ledger has not confirmed whether the European reports are linked to the CryptoBilis incident. CryptoBilis has said it is reviewing its processes with independent specialists.