# Ledger Devices Sold Through Reseller CryptoBilis Carried an LTE Implant That Sent Recovery Phrases to Attackers

On-chain investigators estimate losses of $93 million to $102 million across more than 300 wallets. MediaMarktSaturn suspended Ledger sales in Europe after a buyer in Germany reported modified units.

- Published: 2026-10-22T05:48:52.369Z
- Canonical: https://polylog.news/crypto/2026-10-22/ledger-devices-sold-through-reseller-cryptobilis-carried-an
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [Rekt News](https://www.rekt.news/), [CoinDesk](https://www.coindesk.com/tech/2026/10/13/ledger-says-spy-chip-inside-cryptobilis-ledger-devices-transmitted-wallet-keys-over-mobile-network), [ForkLog](https://forklog.com/en/ledger-implant-in-cryptobilis-sold-wallets-transmitted-recovery-phrases-over-lte/), [Hardware Busters](https://hwbusters.com/news/ledger-hardware-wallet-implant-read-recovery-phrases-off-the-screen-and-sent-them-out-over-lte/), [Tangem](https://tangem.com/en/learning-hub/post/ledger-cryptobilis-incident/), [Yahoo Finance](https://finance.yahoo.com/markets/crypto/articles/ledger-wallet-scare-reaches-4-112158581.html)

Rekt News's post-mortem, titled "Factory Sealed," adds detail to a hardware supply-chain attack Ledger first confirmed on October 13. Devices sold by CryptoBilis, a Southeast Asian authorized reseller, contained a hidden microcontroller. It…

This story is for subscribers. Read it in full at https://polylog.news/crypto/2026-10-22/ledger-devices-sold-through-reseller-cryptobilis-carried-an (subscription information: https://polylog.news/pricing).