CryptoBilis-sold Ledger hardware wallets carried LTE implants that exfiltrated recovery phrases; a Trezor Safe 5 report follows (no CVE)
Severity: critical · Patch status: unknown · Since 2026-10-09
Hardware wallets bought through CryptoBilis, a Southeast Asian reseller authorised for Ledger and Trezor and listed by Ledger as authorised in Indonesia, Malaysia and the Philippines, were found to contain hidden hardware. After wallets were drained on October 9, Ledger confirmed one affected device held an unauthorised implant and its Donjon team described a microcontroller inside the enclosure that reads the 24-word recovery phrase off the screen during setup and sends it out over LTE through an eSIM, without touching the Secure Element, the OS, transactions or signatures. Ledger calls it a physical supply-chain attack, not a breach of its systems, says all confirmed losses involve CryptoBilis-sold devices and that its direct channels are unaffected, but it has not confirmed total losses; third-party on-chain estimates run from $86 million to over $100 million across 300+ wallets. CryptoBilis paused sales and shipments. On October 30 Trezor said a credible responsible-disclosure report, from an Indonesian customer who bought a Trezor Safe 5 via CryptoBilis's Tokopedia store in August 2026, describes an extra board with a cellular module and antenna; Trezor had not yet examined the device, has no reports of lost funds and had already removed CryptoBilis as a reseller. Separately, Singapore police reported on October 28 at least two cases since September 10 (about S$3.5 million) of tampered Ledger wallets bought from Singapore retail stores; those sources do not tie them to CryptoBilis. Unused CryptoBilis devices should not be set up; used ones need funds moved to a new seed on a device from a trusted source, since restoring the old phrase elsewhere does not help.
What to do
- If you bought any Ledger or Trezor (or OneKey) from CryptoBilis, or from a store selling CryptoBilis-supplied stock such as its Tokopedia shop, since March 2026: do not set it up and never type an existing recovery phrase into it.
- If it is already in use: generate a NEW seed on a device bought directly from the vendor and move funds there now; restoring the old backup on another device does not remove the exposure.
- Contact vendor support (Ledger Support / Trezor Support) before opening or shipping the device; keep the device for the replacement or voucher offered, and file a local police report.
- Treat any message offering wallet 'verification' or recovery help as phishing; neither vendor will ask for a recovery phrase.
- Buy hardware wallets only from the vendor's own store; weighing a device is not a reliable tamper check.
Sources
All live incidents on Threat Watch
