Hacking News
Ledger discovers LTE-enabled implants in CryptoBilis‑sold wallets that stole recovery phrases
Ledger reported that LTE-enabled implants found in hardware wallets sold by reseller CryptoBilis captured users’ 24‑word recovery phrases and transmitted them via cellular networks. The implants used a microcontroller and an embedded SIM to decode the phrases displayed during device setup, according to Ledger’s security team Donjon. Ledger confirmed one device contained an unauthorized implant but said the security chips and transaction signing were not compromised. Losses linked to the tampered devices are estimated between $86 million and $103 million, though Ledger has not verified a total amount. CryptoBilis halted sales and shipments of all hardware wallet brands in Malaysia, the Philippines and Indonesia and temporarily closed its stores. Trezor and OneKey removed CryptoBilis from their authorized reseller lists, with OneKey offering free replacements for devices bought between March 1 and Oct 12, 2026.