Hardware implant prompts Ledger reseller sales halt

TLDR

Ledger has confirmed a covert hardware implant in some reseller-sold devices, leading to suspended sales and wider scrutiny of hardware wallet supply chains.

1. Ledger identified an LTE-enabled spy implant in signers sold via Southeast Asian reseller CryptoBilis that can capture the 24-word recovery phrase during setup.
2. CryptoBilis halted all hardware wallet sales, while European retailer MediaMarktSaturn froze Ledger sales and rivals like Trezor and OneKey tightened or cut reseller relationships.
3. The incident highlights that hardware wallet security can be undermined at the reseller level, so users and institutions need to focus on trusted sourcing and follow ongoing investigation updates.

Deep Dive

1. Implant Mechanics And Losses

Ledgers Donjon security team confirmed that some signers sold through authorized reseller CryptoBilis contained an unauthorized LTE module that reads the recovery phrase from the device screen during setup and transmits it over a provisioned eSIM to attackers, without altering the Secure Element or firmware.hardware signers sold by CryptoBilis

Independent onchain analysts have estimated suspected thefts in the range of roughly 86 million to more than 90 million dollars across Bitcoin, Ethereum, Tron and other networks, but Ledger stresses that these totals and the number of affected users remain unverified.spy chip inside CryptoBilis Ledger devices

Ledger says all confirmed losses in the October incident involve devices bought via CryptoBilis, and that its own infrastructure and direct sales channels are not implicated so far.Ledger reveals how hidden chips stole recovery phrases

2. Reseller Sales Halts And Ripple Effects

CryptoBilis initially paused Ledger signer sales, then broadened the halt to all hardware wallet brands across Malaysia, the Philippines and Indonesia, and temporarily closed physical stores while reviewing processes with independent specialists.CryptoBilis halts wallet sales

Separately, European electronics giant MediaMarktSaturn suspended all Ledger hardware wallet sales in stores and online after a German customer reported a tampered unit with unauthorized cabling and a cellular module; no fund losses have been confirmed in that case.MediaMarktSaturn halted Ledger sales

Competitors are reacting too. Trezor removed CryptoBilis from its reseller network and announced it will reduce its broader reseller list as a preventive step, while OneKey revoked CryptoBilis authorization and offered free replacements for devices bought through that reseller in a defined window.Trezor reduces resellers

3. Security Lessons And What To Watch

This is a classic supply chain attack: the hardware wallet design and cryptography remained intact, but physical tampering between factory and user undermined the self-custody model that devices like Ledger are meant to guarantee.

For crypto users, the critical variable is now where and how devices are sourced. Buying sealed devices directly from manufacturers, checking for unexplained cables or modules, and avoiding unsolicited or heavily discounted hardware can reduce exposure to similar attacks.

Investigations by Ledger and affected retailers are ongoing, and key open questions include the full scope of compromised batches, the exact tampering point in the distribution chain, and whether other resellers or brands were touched. Updates from Ledger and major resellers will be important signals for whether trust in hardware wallet supply chains is stabilizing or still deteriorating.

Conclusion

A hardware implant inside reseller-supplied Ledger devices has turned supply chain security into a front line issue for self-custody, prompting sales freezes and reseller shakeups across the industry.

Until investigations clarify the full scope, the safest posture is to assume that the path from factory to your hand is a potential attack surface and to base hardware wallet choices as much on trusted distribution as on technical specs.