(SeaPRwire) –
By: Lucas Caldwell
Cold storage was supposed to be the answer to everything. Get your coins off exchanges, seal them in hardware, sleep well. That promise just took a bullet. Tampered Ledger devices sold through CryptoBilis, an authorized Southeast Asian reseller, carried hidden LTE implants that silently photographed your 24-word recovery phrase during setup and beamed it out over a built-in eSIM. Santiment estimates roughly $90 million gone. Specter puts it above $86 million across Bitcoin, Ethereum, and Tron. Ledger has not verified those totals, but the mechanism is confirmed. The Secure Element was never touched. The hack lived in the plastic shell around it.
The timeline is the ugly part. Mark Karpelès, the former Mt. Gox CEO, says he knows of at least two people who warned Ledger about tampered devices starting in December 2025. No public warning followed. Security researcher Joe Grand reported a malicious implant inside a Nano X on March 4, 2026, a device he bought through Lazada Thailand in August 2025. Ledger said it was investigating. Grand says customers were never told. The crisis only broke on October 9, 2026, when losses tied to CryptoBilis wallets surfaced publicly. Ledger’s Donjon team confirmed the LTE implants on October 13.
Tibane Labs has already cataloged three generations of the implant. The third version was purchased from a Japanese online marketplace and shipped from Malaysia. This is not a one-off garage operation. It is an iterated product line with distribution. Meanwhile, Ledger’s own Genuine Check is effectively blind here. It validates the Secure Element, which the attackers deliberately left untouched. A green checkmark tells you nothing about the radio hiding in the case. Ledger’s advice is blunt. If you set up a CryptoBilis device in the last 90 days, move everything to a new device with a fresh recovery phrase.
The industry response reveals where trust actually sits. Trezor found no tampered units from CryptoBilis but severed ties anyway. OneKey revoked the reseller’s authorization, stripped its reseller listings, and offered free replacements for devices bought between March 1 and October 13. Grand had separately flagged tampered Trezor One and Model T units in August 2026, sold through unauthorized TikTok and Facebook sellers. The pattern is clear. The reseller layer is now the weakest link in hardware wallet security, and every manufacturer knows it. Expect reseller networks to shrink hard and fast.
Ledger’s exposure is reputational, not cryptographic. The Secure Element held. Transactions were never altered. Thieves simply restored wallets elsewhere using stolen seed phrases. But Karpelès raised an unverified claim about a Ledger Flex bought at Singapore’s airport, and MediaMarkt Saturn in Germany paused Ledger sales after a customer report, with no funds lost. Ledger says its European retail stock shows no tampering. It has not said how many users are affected or how the devices entered CryptoBilis’ inventory. Bitcoin slipped 0.4% and Ethereum 1.8% in the week ending October 16. Markets shrugged. Users should not.
The next hardware wallet you buy direct from the manufacturer just became the only hardware wallet worth buying.
Author bio: Lucas Caldwell is a tech opinion leader with millions of followers on X/Twitter, covering hardware security, crypto infrastructure, and supply chain risk with a focus on what vendors refuse to say out loud.