Ledger confirms hardware implant at European reseller

TLDR

Ledger has confirmed a malicious hardware implant in some reseller-supplied devices, prompting a European retail sales freeze and highlighting supply-chain risk for hardware wallets.

1. Ledger says devices sold via CryptoBilis contained an LTE implant that can capture and transmit users 24-word recovery phrases, while MediaMarkt has suspended Ledger sales in Europe during a separate probe.
2. Verified losses are tied to CryptoBilis devices in Southeast Asia, with unverified estimates around $90100 million, underscoring that hardware wallet distribution is now a serious attack surface.
3. Wallet makers and retailers are tightening reseller controls; users should favor direct purchases, treat suspect units as compromised, and follow Ledgers investigation updates before trusting third-party stock again.

Deep Dive

1. What Ledger Confirmed

Ledgers Donjon security team says certain hardware signers sold by Southeast Asian reseller CryptoBilis contained an unauthorized module inside the case that reads the screen during setup, records the 24-word recovery phrase, and sends it over LTE via a provisioned eSIM. This implant is a separate component and does not modify the Secure Element, operating system, or transaction-signing logic, which means the attacker steals the seed rather than altering on-device cryptography. Ledger asked CryptoBilis to pause sales and shipments and stated it has no evidence that its own infrastructure or direct sales channels were compromised, while MediaMarkt Saturn halted Ledger sales across Europe after a customer in Germany reported a tampered unit and had their devices pulled for inspection. These details are laid out in reports from The Block and others, such as this summary.

2. Impact On Users And Security

Ledger says that every confirmed theft so far involves devices bought through CryptoBilis, with on-chain researchers estimating losses in the tens of millions of dollars across Bitcoin, Ethereum, and Tron, but the company stresses those totals and victim counts remain unverified. At the same time, investigators and researchers have reported similarly tampered units in other retail channels in Asia and Germany, including devices bought at Singapores Changi Airport and MediaMarkt, although Ledger has not yet linked those findings to the CryptoBilis case or confirmed associated fund drains. This shows a classic supply-chain attack where a trusted hardware wallet can be physically modified before reaching the buyer, breaking the assumption that a sealed device plus correct firmware is enough to guarantee safety.

3. What To Watch And Practical Steps

In response, other hardware wallet brands are tightening their reseller networks; Trezor is cutting authorization for many partners from January 2027 and OneKey has revoked CryptoBilis and offered replacements for units sold through that reseller, according to follow-up coverage. For users, the safer posture is to buy directly from the manufacturer or a clearly vetted official channel, never type recovery phrases into websites or respond to unsolicited support messages, and treat unused devices from at-risk resellers as compromised until there is clear guidance. If you suspect a device might be affected, the conservative approach is to migrate assets to a new wallet created on a trusted device with a fresh recovery phrase, and to track Ledgers ongoing investigation and retailer announcements before reusing hardware bought through third parties.

Conclusion

Ledgers confirmation of a hardware implant at a reseller is a serious reminder that even offline wallets can be attacked through the supply chain, not just through software exploits or phishing. The immediate impact is concentrated on CryptoBilis-linked devices and European retail stock, but the broader effect is a shift in trust toward manufacturer-direct purchases and stricter reseller vetting. For crypto holders, the key adjustment is to treat hardware sourcing and recovery phrase handling as first-class security concerns, and to watch how Ledger and competitors reshape their distribution models in response.