Ledger confirmed that a hardware implant in devices sold by Southeast Asian reseller CryptoBilis captures the 24-word recovery phrase during device setup. Ledger said the implant transmits the recovery phrase over LTE using a provisioned eSIM. Ledger's Donjon security team said Tuesday that the implant does not modify the device's Secure Element or Ledger operating system. The security team said the implant does not alter transactions or signatures.
Ledger said last week that the company was investigating fund losses among users who bought Ledger products from CryptoBilis. Onchain researchers estimated losses at more than $86 million across Bitcoin, Ethereum and Tron. However, Ledger said the total and the number of affected users remain unverified. Ledger said the figures circulating online came from third parties and had not been fully verified by Ledger. Ledger advised users who lost funds to coordinate with law enforcement before opening the device. Ledger reiterated that the company has no indication that Ledger's infrastructure, systems or services were compromised. Ledger asked CryptoBilis to pause all sales and shipments while Ledger's cybersecurity team examines recovered hardware.
MediaMarkt Saturn halted European sales of Ledger devices in stores and online as of Oct. 13 after a customer in Germany reported an implant. Ledger's update said no loss of funds was reported in that case. An X user said Friday that the user bought two Ledger devices from separate MediaMarkt stores and found unauthorized cables and cellular modules inside both. Those claims have not been independently verified. Former Mt. Gox CEO Mark Karpeles said Tuesday that a Ledger Flex purchased at Singapore's airport contained a spy implant. Ledger referred users to Ledger's CryptoBilis investigation update but did not confirm that the Singapore device was linked to the same incident.
The incident has prompted other hardware wallet makers to tighten their reseller channels. Trezor said the company has no reports of tampered Trezor devices from CryptoBilis and no indication that Trezor products were affected. Trezor removed CryptoBilis from Trezor's reseller list as a precaution. Trezor is also reducing its wider reseller network, according to a letter from Chief Commercial Officer Danny Sanders to partners. The letter said resellers notified under the plan will lose authorization on Jan. 1, 2027. The letter said those resellers will receive no new stock from Trezor but can sell remaining inventory until then. Sanders said there was no evidence that Trezor devices had been compromised and described the changes as preventive.
OneKey reported no customer fund losses linked to the incident. OneKey said the company revoked CryptoBilis' reseller authorization and began reviewing OneKey's wider reseller network. OneKey said sellers operating under questionable legal entities will lose authorization. OneKey is offering free replacements for OneKey devices purchased through CryptoBilis between March 1 and Oct. 13, regardless of model or activation status.
Ledger Confirms Hardware Implants in CryptoBilis Reseller Units, MediaMarkt Halts Sales
FLASH AIShare
Summary
Ethereum news broke as Ledger confirmed hardware implants in devices sold by reseller CryptoBilis, compromising users' 24-word recovery phrases. The implants, using LTE and eSIM, transmit sensitive data during setup. Ledger’s cybersecurity team says the implants don’t alter the Secure Element or OS. Reports show losses exceeding $86 million across Bitcoin, Ethereum, and Tron. Ledger urged impacted users to contact law enforcement before opening devices. MediaMarkt Saturn suspended Ledger sales in Europe after an implant report. AI + crypto news highlights growing risks as other wallet providers, like Trezor and OneKey, removed CryptoBilis from reseller lists and offered free replacements.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.