Ledger details CryptoBilis implant as MediaMarkt halts sales

Ledger says an unauthorized implant in signers sold by Southeast Asian reseller CryptoBilis read users’ recovery phrases during setup and transmitted them over LTE, exposing the keys that control their crypto wallets. In an investigation update reported by The Block on Oct. 13, Ledger’s Donjon security team said the implant used a provisioned eSIM to send the 24-word phrase off-device. MediaMarkt Saturn separately suspended sales of Ledger devices in its stores and online after a customer in Germany reported a tampered unit.

How did the implant capture the recovery phrase?

The implant read the words from the signer’s display while a customer set up the device. CoinDesk’s account of Ledger’s technical update says a microcontroller inside the enclosure recognized and decoded the phrase, then transmitted it over LTE using an eSIM.

A recovery phrase can restore a wallet on another device. An attacker who obtains it can derive the wallet’s keys and move its assets without possessing the original signer. The implant therefore targeted the secret displayed during setup, rather than intercepting a transaction sent later for signing.

Ledger said the implant did not modify the Secure Element or the Ledger operating system, and did not change transactions or signatures. That distinction describes the reported attack path: the device could display and sign transactions as expected while separate hardware copied the recovery phrase from the screen. A device check focused on firmware or transaction signing would not, by itself, prevent a physical component from reading information displayed to the user.

What has Ledger confirmed about the affected devices?

Ledger has confirmed an implant in at least one device and said all confirmed cases tied to the Oct. 9 fund-draining incident involved devices sold through CryptoBilis. The company said the number of affected users and the total losses remain unverified. On-chain researchers cited by The Block estimated losses above $86 million, but Ledger said figures circulating online came from third parties and had not been fully verified.

Ledger said it had no indication that its infrastructure, systems or services were compromised. It asked CryptoBilis to pause sales and shipments while its cybersecurity team examines recovered hardware. CryptoBilis has ceased sales of hardware wallets, according to Ledger’s update.

For customers who bought from CryptoBilis, Ledger’s guidance depends on whether the signer was used. Do not initialize an unused device. If it was already set up, move assets to a new device with a newly generated recovery phrase. That replacement phrase must be created on a device the user trusts; reusing the exposed phrase would leave the same wallet keys in circulation.

Why did MediaMarkt Saturn suspend sales?

MediaMarkt Saturn removed Ledger products from its stores and online platforms after a customer in Germany reported an implant; Ledger said no loss of funds was reported in that case. The retailer’s spokesperson told The Block that the group was in contact with Ledger. The report establishes a sales suspension while the matter is investigated, not that the German customer’s device has been independently linked to CryptoBilis.

Ledger said the investigation is ongoing and is examining where devices were tampered with in the distribution chain. It is reviewing reseller controls and anti-tamper protections. Until investigators establish how the implant entered the supply chain and how widely it was distributed, the confirmed CryptoBilis cases define the known scope; online estimates and other device reports do not establish additional confirmed victims.

Sources and documents

• investigation update reported by The Block — theblock.co
• CoinDesk’s account of Ledger’s technical update — coindesk.com