Recovery phrase caught red-phished 📡 2.

The French hardware wallet maker Ledger said malicious hardware added to devices sold by authorized reseller CryptoBilis captured users' 24-word recovery phrases directly from device screens and transmitted them over LTE cellular networks. According to a Tuesday X post by Ledger, its security research team Ledger Donjon found that the implants used a microcontroller to decode the phrases displayed during setup and relayed them via an embedded SIM (eSIM). Ledger said the implants did not compromise the devices' security chips or alter transactions.

The incident surfaced Friday after crypto losses were reported involving Ledger devices sold through CryptoBilis, which Ledger lists as an authorized reseller in Indonesia, Malaysia and the Philippines. Ledger confirmed Saturday that one affected device contained an unauthorized implant. Blockchain investigator Specter said losses could top $86 million, while cybersecurity outlet Yfarmx raised its own estimate to $103 million. Ledger has not confirmed the total, and the company says it has sold more than 8 million hardware wallets. Ledger urged users who suspect tampering to contact its support team and file a police report, directing customers who bought devices elsewhere to an inspection guide that warns opening a device could damage it and advises backing up recovery phrases first.

Although confirmed losses have so far involved devices sold by CryptoBilis, Ledger said it is examining reports beyond the reseller. Separately, X user Johannes posted photos of two Ledger devices he said he bought from separate stores of European consumer electronics chain MediaMarkt, claiming he found implants in both. Ledger has not confirmed any link between the European reports and the CryptoBilis incident.

CryptoBilis said in an X post on Saturday that it had suspended sales and shipments of all hardware wallet brands across Malaysia, the Philippines and Indonesia, expanding an earlier halt limited to Ledger devices. The reseller also temporarily closed its physical stores and said it was reviewing its processes with independent specialists. Trezor said Monday that it had received no reports of tampered Trezor devices sold through CryptoBilis and found no indication its products were affected, but it removed CryptoBilis from its authorized reseller network. OneKey reported no related user losses and terminated the reseller's authorization, suspending onboarding of new resellers and beginning a review of its existing distribution network. OneKey also offered free replacements for OneKey devices purchased from CryptoBilis between March 1 and Oct. 12, 2026, with customers able to verify eligibility through a verification page.