Ledger said its Donjon security team found an unauthorized hardware implant inside signers sold by Southeast Asian reseller CryptoBilis, which reads the 24-word recovery phrase from the screen during setup and sends it over LTE using a provisioned eSIM. Ledger confirmed the implant on one affected user's device on October 10th, and said all confirmed losses so far involve devices bought from CryptoBilis, which has stopped selling Ledger devices. Onchain investigator Specter traced more than $86 million in suspected thefts across Ethereum, Tron and Bitcoin, but Ledger has not verified the number of affected users or total losses. The company told buyers who have not set up their device not to do so and to contact Ledger Support, while those who have should move assets to a new device with a new recovery phrase and report to police. Ledger is also reviewing reports of implants in other devices and locations.
Summary written by Upside AI from the original article. Read the source for full details.
Read the original on Decrypt ↗
Related news
- Ledger Asks Resellers in Seven Asian Markets to Pull Devices After Suspected $86M Drain
Ledger has asked resellers and distributors in six Southeast Asian countries and Hong Kong to suspend sales and pull its hardware wallets from shelves while it investigates devices fitted with a hidden implant. The implant reads the 24-word recovery phrase during setup and sends it out over LTE, so anyone holding that phrase can move the wallet's funds. All confirmed losses involve devices sold through CryptoBilis, a regional reseller, and Ledger has not verified any drain linked to devices bought elsewhere, nor sees any indication its own systems were compromised. Onchain investigator Specter has traced more than $86 million in suspected thefts, a figure Ledger has not verified. MediaMarkt Saturn stopped selling Ledger devices after a German customer reported an implant, though no funds were lost, and rival Trezor will end reseller authorizations on January 1, 2027 as a precaution.
- Ledger Says All Confirmed Cases in Suspected $87M Drain Tied to Reseller CryptoBilis
Ledger said every confirmed case in last week's wallet-draining incident involves devices sold through Southeast Asian reseller CryptoBilis, while its own systems and direct sales channels remain unaffected. The company described the number of affected devices as “limited,” said it is working with authorities, and noted that CryptoBilis has ceased all hardware wallet sales. Onchain investigator Specter traced more than $86 million in suspected thefts across Ethereum, Tron and Bitcoin, and YFarmX sent Ledger a list of more than 450 drained wallets, though Ledger has not confirmed these figures or the cause. Separately, a user on X claimed to have found tampered Ledger devices in Europe and called for a recall, a claim that has not been independently verified. Ledger has told authorized resellers never to restock returned products and advised CryptoBilis buyers to move their funds to a new seed phrase on a device bought from Ledger.
- Trezor Cuts Its Resellers After Ledger Finds Spy Implant in Crypto Wallets
Trezor will end its reseller authorizations on January 1, 2027 and stop shipping new stock to them, calling it a precaution after supply-chain incidents and saying there is no evidence its devices were compromised. The move follows Ledger's Donjon team finding that wallets sold by Southeast Asian reseller CryptoBilis carried a spy implant that captures recovery phrases from the screen and sends them over LTE. Ledger told anyone who bought from CryptoBilis in the past 90 days not to set up their device, while onchain investigator Specter traced more than $86 million in suspected thefts, a figure Ledger says it has not verified. Trezor says CryptoBilis was already off its seller list and that it has received no reports of tampered devices from that retailer. Separately, a ShipMonk data exposure in August affected Trezor customers, with the total put at 80,689 in September, though Trezor says its devices, private keys and wallet backups were not affected.
- Ledger details LTE-enabled spy implants in wallets sold by CryptoBilis
Ledger said LTE-enabled implants in wallets sold by CryptoBilis captured the 24-word recovery phrases shown on device screens during setup and sent them over cellular networks via an eSIM, without compromising the secure chips or altering transactions. The issue came to light after crypto losses involving devices sold through the reseller, which is listed as authorized in Indonesia, Malaysia and the Philippines. Blockchain investigator Specter estimated losses could exceed $86 million, while Yfarmx put them at $103 million, though Ledger has not confirmed a total. CryptoBilis halted sales of all hardware wallet brands in those three countries, Trezor said it received no reports of tampered devices but removed the reseller, and OneKey terminated its authorization and offered free replacements for devices bought from CryptoBilis in 2026. Ledger is also examining reports beyond the reseller, including European cases involving devices bought from MediaMarkt, but has not confirmed a link.
- Ledger implant tests Bitcoin ETFs as safer custodial solutions than hardware wallets
The discovery of an unauthorized hardware implant in a Ledger wallet has reignited debate over whether Bitcoin ETFs are safer than self-custody with hardware wallets. Some blockchain investigators estimate losses from these implants could top $86 million. Analyst Plan B said his 2025 move of Bitcoin holdings into ETFs was right, while 21Shares co-founder Ophelia Snyder noted large holders have been shifting to ETFs for enhanced security, arguing self-custody depends on investors' technical expertise. Blockstream CEO Adam Back said hardware wallets can still be secure but manufacturers need better threat modelling. Jameson Lopp warned investors against a rushed mass migration that could create new central points of failure.
- Ledger says unauthorized implant found in at least one device sold by CryptoBilis
Related markets
Latest news
- JPMorgan Backs Two Defense Startups With $5 Billion
JPMorgan has already committed half of its $10 billion investment pool to hypersonic-missile maker Castelion and defense manufacturer Hadrian. The bet reflects America's push to rebuild its defense industrial base.
- X-Energy, Amazon, AEP Partner To Evaluate Feasibility Of 960 MW Nuclear Project In Indiana – A Look At The Key Highlights
X-energy and American Electric Power (AEP) announced a joint development agreement to evaluate the feasibility of a proposed 960-megawatt small modular reactor project in Indiana, with Amazon supporting development through a milestone-based funding agreement. The plant would feature 12 Xe-100 units near the former Breed Generating Station in Sullivan County, redeveloping an AEP-owned brownfield site. It is the second commercial project under the X-energy and Amazon collaboration, which aims to bring more than 5 gigawatts of new nuclear capacity to the U.S. grid by 2039. At the time of writing, XE was up 2%, AMZN gained 3.75%, and AEP fell 1.13%.
- Waymo Will Be “a Trillion Dollar Business. Easy” per VC Investor
Bessemer Venture Partners' Sameer Dholakia says Waymo could become a trillion-dollar business by expanding from ride-hailing into personal car ownership, trucking and logistics. The article notes Bessemer invested in Waymo's $16 billion February round, which valued the company at $126 billion. Waymo reached 500,000 paid rides a week in March, but Sacra estimates its annualized revenue at only $355 million in February, under 0.1% of Alphabet's $403 billion in 2025 revenue. Alphabet trades at 25.0x forward earnings, within its usual range, while Uber trades at 18.2x, a level analyst Walter Piecyk links to the threat from Waymo and Tesla's Robotaxi.
- Jensen Huang Declares NVIDIA Can Win “in the Absence of Any AI Labs”
NVIDIA CEO Jensen Huang said on the BG2 podcast that about a third of the business, classical computing unrelated to AI labs, is growing 30% to 40% a year, while frontier labs account for roughly 25% to 30% of compute. In the three months to July 26, 2026, revenue rose 106% to $96.2 billion, with AI clouds, industrial and enterprise revenue up 138%. Steve Eisman cited a 10-Q line showing 70% of NVIDIA's accounts receivable comes from five customers, though the article notes receivables are not the same as revenue share. NVIDIA trades at 17.7x forward earnings, near its three-year low of 17.5x and well below its 30.3x average.
- AWS Margin Expansion and Retail Execution Power Amazon (AMZN) in Q3
Wedgewood Partners reported that its Wedgewood Composite returned 2.5% net in the third quarter of 2026, compared with 2.3% for the S&P 500 and 0.9% for the Russell 1000 Growth. In its investor letter, the firm named Amazon a leading contributor, citing AWS revenue growth accelerating to 37% from 17% a year earlier and a 63% rise in the segment's operating income. AWS backlog of around $500 billion is more than double last year's level and up 37% from 90 days earlier, and Wedgewood said this demand supports a plan to double AWS capacity from circa 2025 levels by 2027. Advertising grew 26% and generated over $75 billion in revenue over the past 12 months. As of October 16, 2026, Amazon closed at $250.00, with a market capitalization of $2.7 trillion and a 21.22% gain over the past year.
- Bitcoin is rejected at $83K as US bond yields reverse higher with equities
Bitcoin failed to follow rising equities as a wall of sell orders above $83,000 across exchanges capped gains, and BTC slipped below $82,000 after Monday's Wall Street open. The Nasdaq Composite gained 1.5% and South Korea's KOSPI rose 1.76% to 5,768 points, while the US 10-year yield climbed to 5.13% and the 30-year to 5.46%, moving in step with stocks ahead of major tech earnings from Meta, SpaceX and Tesla. QCP Capital warned that a repeat of last week's tech sell-off could threaten the $80,000 support level. Crypto liquidations totaled $335 million over 24 hours, and the Binance whale ratio fell to 0.45 from 0.54 at the start of October.
Get the briefing on Telegram or Zalo
Join the Upside Telegram channel or Zalo group for the Vietnam stocks and gold briefing at 8:00 and 19:00 (Vietnam time) on trading days, plus a weekly wrap on Saturday morning.