Ledger Finds LTE Seed-Stealing Implant in Wallets Sold by CryptoBilis, $86M Drained

Hardware wallet maker Ledger has confirmed that at least one device sold by CryptoBilis, an authorized reseller in Indonesia and Malaysia, carried an unauthorized hardware implant built to steal the wallet's recovery phrase. Pseudonymous blockchain investigator Specter puts total losses among Southeast Asian users above $86 million. Ledger has not confirmed a victim count or a dollar figure. It has, however, widened its sales pause to resellers and distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong.

The attack never touches Ledger's Secure Element or firmware. It goes around them. That makes this a physical supply chain compromise in the plainest sense: the device does what it was designed to do, and a second, hidden device watches it.

How the Implant Works

In its October 13 update, Ledger described the implant as a separate component inside the device enclosure. It does not modify the Secure Element or the Ledger operating system, and it does not alter transactions or signatures. Its only job is to read what the screen shows.

• During first-time setup, the signer shows the 24-word recovery phrase on its display, as it is designed to.
• The implant detects those setup screens and its onboard microcontroller decodes the displayed words.
• The decoded seed is sent out over LTE using a provisioned eSIM, so the implant never needs the victim's phone, computer or Wi-Fi.
• Once the operator has the seed, the wallet can be rebuilt on any device and emptied. No malicious transaction ever has to pass through the victim's signer.

This design gets past the controls hardware wallets are built around. On-device transaction review does not help, because the theft happens at setup, not at signing time. Attestation of the Secure Element also comes back clean, because the Secure Element was never touched.

Three Generations, Multiple Channels

Ledger's findings match an earlier report from Tibane Labs, which documented three variants of the implant, each more advanced than the one before. Tibane Labs rates the third generation as the most sophisticated. It did not come from CryptoBilis. The researchers bought it on Amazon Japan from a third-party seller based in China, and the parcel shipped from Malaysia.

Tibane Labs summed up the problem: "a listing on a mainstream marketplace, a seller in one country, a shipment from another, and nothing on the box to tell it apart from a genuine new device."

A third channel turned up in Europe. Ledger said MediaMarkt Saturn paused Ledger sales in its stores after a customer in Germany found an implant. No loss of funds was reported in that case. Ledger's latest statement says the only confirmed drains are still in Southeast Asia, and that it has not verified a drain linked to a device bought anywhere else.

So far the evidence shows the same implant design reaching buyers through an authorized regional reseller, a global marketplace and a major European electronics retailer. Ledger says its investigation is still working to determine who tampered with the devices and where in the distribution chain it happened.

Vendor and Reseller Response

Ledger's actions and guidance so far:

• Paused sales through CryptoBilis (Indonesia and Malaysia), Shopee Mall (Malaysia and the Philippines) and LazMall (the Philippines). Ledger has not said whether every one of these pauses is tied to this incident.
• On October 13, asked resellers and distributors across Southeast Asia and Hong Kong to suspend sales and pull Ledger devices from shelves.
• Told buyers from CryptoBilis in the last 90 days not to set up devices they have not yet initialized, and advised those who already set them up to move assets to a new Ledger signer with a new seed.
• Told resellers to source stock only through authorized channels and never to restock returned products.
• Said it has no indication that its own infrastructure, systems or services were compromised.

CryptoBilis has stopped selling all hardware wallet inventory until the investigation ends. Its customer alert says a wallet should be treated as unsafe if it arrived with a recovery phrase already printed or written on a card, or if anyone other than the owner has seen the phrase. That warning covers a cruder and older pre-seeded wallet scam. The implant here is more dangerous because the owner generates the seed correctly on the device and is still compromised.

Why This Matters Beyond Crypto Hobbyists

Many organizations hold digital assets on hardware signers: treasury reserves, exchange cold storage, payment operations and custody desks. Procurement teams often buy these devices like any other peripheral, from whichever reseller or marketplace has stock. This incident shows that a reseller's "authorized" status does not guarantee the device was untouched along the way, and that marketplace listings can carry modified hardware that looks identical in the box.

The wider lesson applies to any trusted hardware. Secure enclaves and firmware attestation protect what sits inside their boundary. They say nothing about extra hardware placed next to that boundary. A display, keyboard or sensor that handles secrets in plaintext is an attack surface that silicon attestation cannot see. Putting a cellular radio inside the case removes the air gap that hardware wallet threat models usually take for granted.

RedEye Assessment

This is a well-resourced operation. It covers three hardware generations, uses provisioned cellular connectivity, and spans distribution in at least Southeast Asia, Japan and Germany. Someone is building, provisioning and repackaging devices at scale and feeding them into both authorized and marketplace channels. Until Ledger names the point of insertion, treat any signer bought outside direct vendor channels during the affected window as unverified, and keep in mind that the vendor's own integrity check cannot clear it. We expect more reseller pauses, a higher confirmed loss figure, and a rise in fake "recovery" outreach to victims over the coming weeks.