Tuesday 13 October 2026
Evening Edition
ZOTPAPER

News without the noise

ZOTPAPER
Security

Ledger finds LTE spy implants in wallets sold by reseller CryptoBilis

Tampered devices captured recovery phrases and transmitted them over cellular networks; CryptoBilis halts sales, Trezor and OneKey cut ties

By LineZotpaper
Published
Read Time1 min
Ledger, the French hardware wallet maker, has revealed that wallets sold through reseller CryptoBilis contained LTE-enabled spy implants capable of capturing users' recovery phrases. CryptoBilis has halted sales, and rival hardware wallet makers Trezor and OneKey have cut ties with the reseller.

Ledger's security research team, Ledger Donjon, found that malicious implants in wallets sold by CryptoBilis used a microcontroller to decode the 24-word recovery phrases displayed on the device screen during setup. The captured data was then transmitted over LTE networks using an embedded SIM (eSIM), according to the company.

Recovery phrases are the cryptographic keys that control a hardware wallet. Anyone who obtains a phrase can access and drain the cryptocurrency stored in the corresponding wallet, making the silent capture of these phrases a direct threat to users' funds.

The discovery has prompted Commercial response across the industry. CryptoBilis has halted sales of the affected wallets, while Trezor and OneKey, which also produce hardware wallets, have distanced themselves from the reseller.

§

Analysis

Why This Matters

  • The implants expose recovery phrases, the keys to wallet funds, putting affected users at direct risk of theft.
  • The case highlights supply chain tampering risks in the crypto hardware market, where buyers must trust devices sold through third-party resellers.
  • The disclosure raises questions about how widespread the tampering is and whether other resellers are affected.

Background

Hardware wallets are designed to store cryptocurrency private keys offline, keeping them out of reach of internet-based attacks. During setup, the device displays a recovery phrase, typically a sequence of words, which the owner must back up. Anyone who obtains that phrase can control the wallet. Tampered devices that silently capture this phrase defeat the entire security model of hardware storage.

Key Perspectives

Ledger: The manufacturer identified the implants through its Donjon security research team and disclosed the technical mechanism to warn affected users. CryptoBilis: The reseller halted sales of the affected wallets after the discovery. Trezor and OneKey: Competing wallet makers cut ties with the reseller, signalling caution to their own customers. Critics/Skeptics: Supply chain tampering of this kind is difficult for individual buyers to detect, raising questions about how consumers can verify the authenticity of hardware wallets purchased from third-party resellers.

What to Watch

  • Whether Ledger issues specific guidance or verification steps for buyers of CryptoBilis units.
  • Whether investigations expand to other resellers or batches of devices.
  • Whether the scale of affected wallets and any associated fund losses become public.

Sources

Zotpaper

Written by software from the reporting listed above, scored by an automated standards desk, and published without a person reading it first. If something here is wrong, tell the editor and it will be put right.

How we workSubscribe