# Implants in Reseller-Sold Ledger Wallets Transmitted Recovery Phrases Over Mobile Networks, With Losses Estimated Near $100 Million

Ledger traced the tampered units to CryptoBilis, a Southeast Asian reseller, and MediaMarkt Saturn stopped European sales after a tampered device was found in Germany.

- Published: 2026-10-23T05:49:02.326Z
- Canonical: https://polylog.news/crypto/2026-10-23/implants-in-reseller-sold-ledger-wallets-transmitted-recover
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [Rekt News](https://www.rekt.news/), [CoinDesk](https://www.coindesk.com/tech/2026/10/13/ledger-says-spy-chip-inside-cryptobilis-ledger-devices-transmitted-wallet-keys-over-mobile-network), [The Block](https://www.theblock.co/news/business/2026-10-13-ledger-confirms-hardware-implant-cryptobilis-reseller-units-mediamarkt-suspends-sales-europe-418442), [ForkLog](https://forklog.com/en/ledger-implant-in-cryptobilis-sold-wallets-transmitted-recovery-phrases-over-lte/)

Ledger confirmed that some of its hardware wallets sold by CryptoBilis, a Southeast Asian reseller, contained hidden hardware that stole users' recovery phrases. When a buyer set up the device, the screen showed the 24-word recovery phrase. A small microcontroller in the implant recognized and decoded those words and sent them to the attacker over the mobile network through an embedded SIM card, [CoinDesk reported](https://www.coindesk.com/tech/2026/10/13/ledger-says-spy-chip-inside-cryptobilis-ledger-devices-transmitted-wallet-keys-over-mobile-network).

The attack used physical tampering in the supply chain. It did not break Ledger's secure chip, which still protected the keys stored inside it. Instead, the implant copied the phrase at the one moment the device displays it to its owner. Anyone holding that phrase can rebuild the wallet on other hardware and move the funds. [Rekt News](https://www.rekt.news/) described a sealed box that carried a mobile-network (LTE) modem and transmitted the 24 words by radio without the owner's knowledge.

Estimates of the losses differ. Rekt cites the analytics firm Bitquery, which counts about $102 million drained from CryptoBilis buyers. On-chain researchers quoted by [ForkLog](https://forklog.com/en/ledger-implant-in-cryptobilis-sold-wallets-transmitted-recovery-phrases-over-lte/) put the figure at up to $93.2 million across 300 wallets. None of the reports reviewed here mention a freeze, a recovery or an attribution. Investigators have not determined who tampered with the devices or at what point in distribution it happened.

The case widened in Europe. MediaMarkt Saturn, the large electronics retailer, stopped selling Ledger devices in Europe after a customer in Germany reported a tampered unit, [The Block reported](https://www.theblock.co/news/business/2026-10-13-ledger-confirms-hardware-implant-cryptobilis-reseller-units-mediamarkt-suspends-sales-europe-418442). Rekt says implants have since appeared in devices from MediaMarkt. The Block's reporting describes a single customer report. The evidence so far does not settle whether the German unit came from the same operation.

## What this means

A hardware wallet's security model assumes that nothing changes the device between the factory and the user. Authorized resellers sit inside that trusted chain, so an implant inserted through a reseller defeats the product's main selling point without breaking any cryptography. Ledger and other single-vendor hardware makers lose because their retail distribution now counts as attack surface. Regulated custodians, spot exchange-traded funds and multi-party computation (MPC) wallet providers gain, because they can claim that no single device sees the full key. The closest precedent is the 2020 leak of Ledger's customer database, after which attackers mailed counterfeit devices to individual buyers in 2021. Those attacks reached people one at a time. This one ran through a sales channel at scale, which is new. The common advice to buy only from authorized sellers offers less protection if a major authorized retailer is affected. The likelier outcome is that hardware vendors add device-authenticity checks during setup within months, and that holders of large balances spread keys across several devices or move them to custody. That depends on whether more implants appear outside CryptoBilis stock. The forward read is wrong if forensic work shows the German unit was an isolated returned-and-resold device and the loss total stops rising.

## What to watch

- Ledger's forensic findings on where in distribution the tampering happened. A breach at a regional distributor would put far more stock at risk than one reseller would.
- Whether MediaMarkt Saturn resumes Ledger sales and on what verification terms. That decision will show whether European retail still serves as a channel for self-custody hardware.
- Whether the wallets holding the stolen funds start moving to exchanges or mixers. That activity would give the first evidence for any attribution.