Ledger confirms recovery-phrase implant as MediaMarkt halts European sales

Ledger confirmed that a hardware implant in devices sold by Southeast Asian reseller CryptoBilis captures the 24-word recovery phrase during device setup. Ledger said the implant transmits the recovery phrase over LTE using a provisioned eSIM. Ledger's Donjon security team said Tuesday that the implant does not modify the device's Secure Element or Ledger operating system. The security team said the implant does not alter transactions or signatures.

Ledger said last week that the company was investigating fund losses among users who bought Ledger products from CryptoBilis. Onchain researchers estimated losses at more than $86 million across Bitcoin, Ethereum and Tron. However, Ledger said the total and the number of affected users remain unverified. Ledger said the figures circulating online came from third parties and had not been fully verified by Ledger. Ledger advised users who lost funds to coordinate with law enforcement before opening the device. Ledger reiterated that the company has no indication that Ledger's infrastructure, systems or services were compromised. Ledger asked CryptoBilis to pause all sales and shipments while Ledger's cybersecurity team examines recovered hardware.

MediaMarkt Saturn halted European sales of Ledger devices in stores and online as of Oct. 13 after a customer in Germany reported an implant. Ledger's update said no loss of funds was reported in that case. An X user said Friday that the user bought two Ledger devices from separate MediaMarkt stores and found unauthorized cables and cellular modules inside both. Those claims have not been independently verified. Former Mt. Gox CEO Mark Karpeles said Tuesday that a Ledger Flex purchased at Singapore's airport contained a spy implant. Ledger referred users to Ledger's CryptoBilis investigation update but did not confirm that the Singapore device was linked to the same incident.

The incident has prompted other hardware wallet makers to tighten their reseller channels. Trezor said the company has no reports of tampered Trezor devices from CryptoBilis and no indication that Trezor products were affected. Trezor removed CryptoBilis from Trezor's reseller list as a precaution. Trezor is also reducing its wider reseller network, according to a letter from Chief Commercial Officer Danny Sanders to partners. The letter said resellers notified under the plan will lose authorization on Jan. 1, 2027. The letter said those resellers will receive no new stock from Trezor but can sell remaining inventory until then. Sanders said there was no evidence that Trezor devices had been compromised and described the changes as preventive.

OneKey reported no customer fund losses linked to the incident. OneKey said the company revoked CryptoBilis' reseller authorization and began reviewing OneKey's wider reseller network. OneKey said sellers operating under questionable legal entities will lose authorization. OneKey is offering free replacements for OneKey devices purchased through CryptoBilis between March 1 and Oct. 13, regardless of model or activation status.