Ledger says hardware wallets sold by Southeast Asian reseller CryptoBilis contained a hidden component built to steal their owners’ recovery phrases.
The findings come from Ledger’s Donjon security team. The implant reads the device screen and decodes the recovery phrase when it is displayed during setup. It then sends the words out over LTE mobile data using an eSIM built into the hardware.
Why owners did not notice
The implant does not alter the secure chip that stores the keys, or the device’s operating system. A tampered wallet looks and works normally. The recovery phrase is captured the moment it appears on screen, so funds can be taken later with no further warning.
On-chain investigator Specter has traced more than $86 million in suspected thefts linked to the case. Ledger says it has not verified that figure, and has not said how many devices were affected.
Trezor tightens its own network
Rival Trezor is reacting too. It will end authorisations for some of its resellers on 1 January 2027, though they can keep selling existing stock through the holiday season. It has not said how many resellers are affected.
“This is a precautionary measure to protect our supply chain and our customers,” Trezor chief commercial officer Danny Sanders wrote in a letter to resellers. Those that remain will face an updated legal framework and tighter rules on how devices are sourced, stored and handled.
Trezor says “there is not a single piece of evidence” that its own devices have been compromised. CryptoBilis was already off its list of sellers, and it has had no reports of tampered Trezor devices from that retailer.
What to do
Ledger’s advice is that anyone who bought from CryptoBilis in the past 90 days should not set the device up. Anyone who already has should move their funds to a new recovery phrase on a device bought directly from Ledger.
Trezor warns owners not to open their device casing to check for tampering, which can damage it, and to contact support instead if something seems wrong.
Both companies say the same thing: buy only from official shops or authorised resellers.
