Implanted hardware wallets: the CryptoBilis channel now reaches Ledger and Trezor, and the integrity checks miss it

The finding

A second hardware wallet maker has reported an implanted device sold through CryptoBilis, a Southeast Asian reseller. On 30 October Trezor said it had a credible report of an extra circuit board, with a cellular module and antenna, inside a Trezor Safe 5 bought in August through the reseller’s Tokopedia store ^[1][2]. Ledger confirmed implants in CryptoBilis-sold devices on 10 October ^[7][11]. Two days before Trezor’s notice, Singapore police said tampered Ledger wallets bought from local retail stores were linked to about S$3.5 million in losses ^[9]. This is not an attack on cryptography. It targets the distribution channel and the moment a device shows its recovery phrase.

What has been confirmed

Ledger’s description is the most complete. The implant is a separate component inside the enclosure. It reads the screen during setup, decodes the 24-word recovery phrase and sends it over LTE through a provisioned eSIM ^[4][5][7]. It does not modify the Secure Element, the operating system, transactions or signatures ^[4][6]. That is why Ledger’s Genuine Check cannot detect it while the Secure Element is intact ^[4][5]. Researchers at Tibane Labs reported three variants of increasing sophistication, according to The Hacker News ^[4].

Trezor’s report describes the same pattern. A board sits between the main board and the display, with a cellular module, and transmits what the screen shows when the device is plugged in ^[1]. Trezor had not examined the unit when it published ^[1][3]. It had inspected four other CryptoBilis devices and found no tampering ^[3]. It declines to attribute the implant or to compare it with Ledger’s case while investigations continue ^[1][2].

Timeline

• March 2026: start of the purchase window that OneKey and Trezor apply to CryptoBilis devices ^[1][7].
• 10 September: first of at least two reports to Singapore police ^[9].
• 9 October: Ledger opens an investigation into losses among CryptoBilis buyers. Trezor removes CryptoBilis as a reseller the same day ^[1][5].
• 10-11 October: Ledger confirms an implant in an affected user’s device ^[4][11].
• 13 October: Ledger asks distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to halt sales. MediaMarkt Saturn withdraws Ledger products in Germany after a customer report ^[5][6].
• 28 October: Singapore Police Force advisory. Trezor receives the Safe 5 report ^[1][9].
• 30 October: Trezor publishes its notice ^[1].

Where the figures disagree

Nobody with first-hand access has published a loss total. Ledger says it has not confirmed the number of affected users or the value lost ^[6][7]. Third-party on-chain estimates differ:

• Specter: more than US$86 million across Bitcoin, Ethereum and Tron ^[4][8].
• Bitquery: US$93.2 million from 315 wallets across six blockchains ^[7].
• YFarmX: US$103.4 million across 530 addresses. It earlier said it had sent Ledger a list of more than 450 drained wallets ^[7][8].

The spread depends on which addresses each analyst counts as victims. None of the totals is verified. The Singapore figure is different in kind. It is about S$3.5 million, roughly US$2.7 million, across at least two police reports ^[9][10]. Police did not name the stores ^[9]. The first of those reports predates the public disclosure by a month ^[9][10].

Scope is also contested. Ledger says all confirmed losses involve CryptoBilis devices ^[5][7]. Separate reports concern a Ledger Flex bought at Singapore’s airport and devices bought at MediaMarkt in Germany ^[6][7]. Ledger has not confirmed a link to CryptoBilis, and said an inspection of European inventory found no tampering ^[4][6]. One third-generation unit examined by Tibane Labs was reportedly bought on Amazon Japan from a China-based seller and shipped from Malaysia ^[4].

What it means

Three points matter for defenders. First, the vendor integrity check measures the wrong thing. A genuine Secure Element inside a modified enclosure passes ^[4][5]. Second, a seed phrase shown on a compromised device is compromised wherever it is later restored. Trezor says restoring the old backup on another device does not solve the problem ^[1]. Third, the channel is regional and layered. CryptoBilis sold in Indonesia, Malaysia and the Philippines and has suspended sales of every brand it carried ^[7]. The Hacker News also lists paused sales at Shopee Mall in Malaysia and the Philippines, without a confirmed link ^[4]. Reports now span a marketplace storefront, physical retail and an airport shop ^[1][6][9]. Authorised-reseller status did not prevent any of it ^[1][5].

The operation shows planning. A provisioned eSIM, a screen-reading decoder and multiple hardware revisions are not opportunistic tampering ^[4][7]. That effort pays only against wallets worth draining, and the reported losses show it found them ^[4][7]. The same economics apply to any device whose security assumes the enclosure is trusted.

Attribution is open. Ledger says it is still determining who tampered with the devices and where in the distribution chain ^[4]. Trezor says it does not know who is responsible ^[1][2]. No vendor or police force has attributed the operation.

What to do

• Treat any wallet bought from CryptoBilis since March 2026 as compromised. Do not initialise it. Move funds to a new seed generated on a device bought from the manufacturer ^[1][7][9].
• If funds were lost, contact police before opening the device. Ledger asks victims to coordinate with law enforcement first ^[6].
• Organisations holding treasury, custody or validator keys should buy direct, record serial numbers on receipt, inspect enclosures and generate seeds in a controlled setting. Trezor notes that weight alone is not a reliable tamper test ^[1].
• Do not rely on vendor genuineness checks to clear a device whose chain of custody is unknown ^[4][5].
• Expect phishing that uses the incident. Ledger, Trezor and the Singapore police all warn that no legitimate party will ask for a recovery phrase ^[1][8][9].
• Fraud and consumer-protection teams in Malaysia and the wider region should note the marketplace and mall-store channels named in the sales pauses ^[4][7].

Domain close

Hardware wallets assume the box around the secure chip is trusted. This operation removed that assumption at the reseller. The control that works is procurement: knowing who handled the device between the factory and first power-on.