Ledger details LTE-enabled spy implants in wallets sold by CryptoBilis
Summary
Ledger said implants in wallets sold by CryptoBilis captured recovery phrases displayed during setup and sent them over LTE via embedded SIMs. The devices’ security chips and transaction signing were not compromised. Ledger confirmed one affected device and is investigating reports beyond the reseller; estimates of losses range from $86 million to $103 million, but Ledger has not verified a total. CryptoBilis halted wallet sales and shipments across three Southeast Asian countries and temporarily closed its stores. Trezor and OneKey reported no evidence their devices were affected but removed CryptoBilis from their authorized reseller networks. OneKey is offering replacements for eligible devices bought from the reseller.
