Ledger confirms hardware implant in CryptoBilis reseller units as MediaMarkt suspends sales in Europe

Ledger has confirmed that a hardware implant found inside its signers sold by Southeast Asian reseller CryptoBilis captures the 24-word recovery phrase during device setup and transmits it over LTE using a provisioned eSIM. 

The implant does not modify the device's Secure Element or Ledger operating system, or alter transactions and signatures, the company's Donjon security team said Tuesday in an X post. 

Ledger's update comes after the company said last week that it was investigating fund losses from users who bought its products from CryptoBilis. Onchain researchers had estimated losses at more than $86 million across Bitcoin, Ethereum and Tron. 

However, Ledger said the total remains unverified, as does the number of users affected.

"Figures circulating online come from third parties and Ledger has not fully verified them," the post read. "If you lost funds, coordinate with law enforcement before opening the signer." 

Ledger reiterated that it has no indication its infrastructure, systems, or services were compromised. The company also asked CryptoBilis to pause all sales and shipments while its cybersecurity team examines recovered hardware.

MediaMarkt suspends Ledger sales as fallout widens

Separately, MediaMarkt Saturn stopped selling Ledger devices in stores and online as of Oct. 13 after one customer in Germany reported an implant. No loss of funds was reported in that case, according to Ledger's update on the matter. 

"We take this incident very seriously," a MediaMarkt Saturn spokesperson told The Block. "The MediaMarktSaturn Retail Group has removed all of the manufacturer's affected products from its stores and online platforms and is in contact with the manufacturer."

On Friday, an X user known as Johannes said he bought two Ledger devices from separate MediaMarkt stores and found unauthorized cables and cellular modules inside both. Those claims have not been independently verified.

Former Mt. Gox CEO Mark Karpelès also said Tuesday that a Ledger Flex purchased at Singapore's airport contained a spy implant. Ledger referred users to its CryptoBilis investigation update but did not confirm that the Singapore device was linked to the same incident.

Trezor tightens reseller controls as OneKey offers replacements

The fallout has pushed other hardware wallet makers to tighten their reseller channels. Trezor said it has no reports of tampered devices from CryptoBilis and no indication its products were affected, but it has removed the reseller from its list as a precaution.

The company is also reducing its wider reseller network, according to a letter from Chief Commercial Officer Danny Sanders to partners. Resellers notified under the plan will lose authorization on Jan. 1, 2027, and will receive no new stock from Trezor, although they can sell remaining inventory until then.

"There is not a single piece of evidence that Trezor devices have been compromised," Sanders wrote. "This is a preventive step, taken out of an abundance of caution."

OneKey, meanwhile, reported no customer fund losses linked to the incident. The company said it has revoked CryptoBilis' reseller authorization and begun reviewing its wider network, adding that sellers under questionable legal entities will lose authorization.

The company is offering free replacements for OneKey devices purchased through CryptoBilis between March 1 and Oct. 13, regardless of model or activation status.