Ledger Wallet Tampering: Sales Halted in Asia and Europe After Implant Found

TLDR

• Ledger confirmed that wallets sold by CryptoBilis held an implant that captures recovery phrases and sends them over LTE.
• Onchain researchers estimate losses above $86 million, but Ledger says the figure is unverified.
• MediaMarkt Saturn stopped selling Ledger devices in Europe on Oct. 13.
• Trezor is cutting its reseller network, and OneKey is offering free replacements.
• Ledger asked resellers in six Southeast Asian countries and Hong Kong to suspend sales.

---

Ledger has confirmed that a hidden implant was found in hardware wallets sold by a Southeast Asian reseller called CryptoBilis. The device captures a user’s recovery phrase and sends it out over a cellular network.

Incident Update – Oct 13th, 2026

Ledger is asking resellers and distributors in Southeast Asia and Hong Kong to suspend sales of Ledger devices while the investigation is ongoing. This includes taking products off the shelves.

Specifically the countries are: Indonesia,…

— Ledger (@Ledger) October 13, 2026

The investigation became public on Oct. 9 after reports of stolen crypto linked to devices bought through the reseller. Ledger’s Donjon security team shared its findings in a post on X on Tuesday.

According to Ledger, the implant reads the 24-word recovery phrase during device setup. It then sends the phrase over LTE using a provisioned eSIM.

How the Implant Works and What Was Lost

The implant does not change the device’s Secure Element or the Ledger operating system. It also does not alter transactions or signatures, according to Donjon.

Update from Ledger Donjon on the CryptoBilis investigation 🔽@DonjonLedger is investigating Ledger signers sold by CryptoBilis, a reseller in Southeast Asia, that contained an unauthorized hardware implant. Ledger confirmed this on October 10th for one affected user’s signer.…

— Ledger (@Ledger) October 13, 2026

Onchain researchers estimated losses at more than $86 million across Bitcoin, Ethereum and Tron. Ledger says those figures come from third parties and have not been fully verified.

Ledger also says the number of affected users is unconfirmed. It advised people who lost funds to work with law enforcement before opening the signer.

The company says it has no sign that its own systems, services or direct sales channel were compromised. It asked CryptoBilis to pause all sales and shipments.

Retailers and Rivals React

MediaMarkt Saturn stopped selling Ledger devices in stores and online as of Oct. 13. A customer in Germany had reported a tampered unit, and no loss of funds was reported in that case.

A MediaMarkt Saturn spokesperson said the company takes the incident very seriously. The retailer has removed the affected products and is in contact with the manufacturer.

An X user known as Johannes said he found unauthorized cables and cellular modules in two devices bought from separate MediaMarkt stores. Those claims have not been independently verified.

Former Mt. Gox CEO Mark Karpelès said a Ledger Flex bought at Singapore’s airport held a spy implant. Ledger did not confirm that this device was tied to the same incident.

Trezor said it has no reports of tampered devices and no sign its products were affected. It removed CryptoBilis from its reseller list as a precaution.

Trezor is also cutting its wider reseller network. Resellers who are notified will lose authorization on Jan. 1, 2027, and can sell remaining stock until then.

OneKey said it has no customer fund losses tied to the incident and has revoked CryptoBilis’ authorization. It is offering free replacements for devices bought through CryptoBilis between March 1 and Oct. 13.

On Tuesday, Ledger asked sellers and distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales and remove its wallets from shelves. Ledger says confirmed incidents remain in Southeast Asia, though users in Europe have reported suspected tampering. The investigation into who tampered with the devices is ongoing.