Ledger Wallets Sold by CryptoBillis Suspected of Hardware Tampering Leading to Crypto Thefts

Key points

• Ledger investigating tampered wallets sold by CryptoBillis.
• Hardware implant intercepts seed passphrases via embedded SIM.
• Over $86 million stolen from hundreds of wallets.
• Impacts users in Southeast Asia; Ledger's direct sales unaffected.
• Ledger paused product sales through reseller CryptoBilis.
• Ledger advises users who purchased from CryptoBilis in the last 90 days to avoid setup or move assets.
• CryptoBilis ceased sales of all hardware wallet inventory.
• Specter, a pseudonymous blockchain investigator, reported the $86 million loss.
• Tampered devices were available for nearly half the price of original hardware.
• Ledger launched an investigation on October 9.
• Ledger confirmed hardware tampering on October 10.
• Attackers are selling manipulated Ledger Nano X hardware wallets.
• The tampered wallets contain an eSIM and additional hardware.
• The modification allows thieves to steal cryptocurrency by transmitting seed phrases via mobile networks.
• Approximately $93 million in cryptocurrency was stolen from over 300 affected wallets.
• The additional chip intercepts the transmission from the Secure Element to the built-in screen.
• The chip recognizes the displayed letters of the seed phrase.
• An analysis by Tibane Labs indicated the embedded Tempest.
• Compromised Ledger wallets were also sold in Europe.
• The first booby-trapped wallet originated from reseller Cryptobilis.
• The offending unit came from a store in Malaysia.
• Cryptobilis also sells in Indonesia and the Philippines.
• A hacked wallet came via Amazon Japan, bought from a Chinese seller and shipped from Malaysia.
• Cryptobilis sells other brands of wallets such as Trezor, Coolwallet, and Tangem.
• Mark Karpelès has been looking into hacked wallets.
• Ledger confirmed on October 13 that all fund losses involved a signer sold through CryptoBilis.
• Someone along the distribution chain manually soldered the hardware implant to the device’s circuit.
• Ledger is reviewing its sales policies.
• Ledger is reviewing anti-tampering protection on its devices.
• Users with tampered signers should contact Ledger support for shipping instructions.
• Ledger CEO Pascal Gauthier said physical supply chain tampering is an industry risk.
• Ledger is inviting researchers and other vendors to collaborate in assessing practices.
• Ledger asked resellers and distributors in Southeast Asia and Hong Kong to halt sales.
• Ledger's Donjon security arm shared details about the hardware implant.
• The implant's microcontroller detects and decodes the 24-word recovery phrase.
• The implant transmits the recovery phrase over LTE using a provisioned eSIM.
• The implant is a separate component that does not modify the Secure Element.
• Keystone will destroy 18,835 unsold hardware wallets.
• An attacker stole Keystone's device verification key from its website.
• The stolen key could allow counterfeit Keystone devices to pass authenticity checks.
• Keystone found unauthorized access on October 20.
• The attacker exploited a vulnerability in a third-party database.
• Trezor warned of a suspected hardware implant in a Trezor Safe 5 wallet.
• A customer reported a Trezor Safe 5 from CryptoBilis had an extra circuit board.
• The extra circuit board in the Trezor Safe 5 sends the recovery phrase over a mobile network.
• Trezor advises customers who bought devices from CryptoBilis since March 2026 to move funds.
• The report came from a customer in Indonesia who bought the wallet in August.
• The Trezor wallet was purchased from CryptoBilis via the marketplace Tokopedia.
• The extra board sits between the Trezor wallet's main board and screen.
• The Trezor implant has a cellular module and an antenna.
• The Trezor implant reads the screen and sends data when the device is plugged in.
• Trezor has not yet examined the reported device.
• No CryptoBilis buyer has reported losing funds to Trezor.