Ledger Warns of LTE Implants in CryptoBilis Wallets Stealing Seed Phrases
Unauthorized hardware modifications in CryptoBilis wallets captured users' recovery phrases and transmitted them via cellular networks.
Unauthorized hardware modifications in CryptoBilis wallets captured users' recovery phrases and transmitted them via cellular networks. This is an original TLT brief synthesising 3 outlets (Bitcoin World, Unchained, Cointelegraph), plus live market data, as of Wed, 14 Oct 2026 11:00:08 UTC.
This incident highlights the risks of hardware supply chain attacks in the crypto space, potentially compromising user funds and eroding trust in hardware wallet security. It also underscores the importance of verifying hardware sources and the potential vulnerabilities of even reputable brands when third-party resellers are involved.
- CryptoBilis wallets contained hidden LTE implants capturing 24-word seed phrases.
- Ledger says Secure Element and OS remained uncompromised in affected devices.
- CryptoBilis halted sales, while Trezor and OneKey cut ties with the reseller.
- Market remains stable despite security concerns, with Bitcoin down 0.45% in 24h.
All three outlets - Bitcoin World, Unchained, and Cointelegraph - confirm that Ledger discovered unauthorized LTE-enabled implants in hardware wallets sold by Southeast Asian reseller CryptoBilis. These implants captured users' 24-word recovery phrases and transmitted them via cellular networks. Unchained specifies that the Secure Element and operating system of the affected devices were not compromised, while Cointelegraph adds that CryptoBilis has suspended sales and that Trezor and OneKey have severed ties with the reseller. There are no significant discrepancies in the reporting across outlets.
Ledger has issued a security alert after discovering that hardware wallets sold by Southeast Asian reseller CryptoBilis contained unauthorized LTE implants designed to steal users' cryptocurrency. These implants covertly captured the 24-word recovery phrases used to restore access to crypto wallets and transmitted them over cellular networks.
According to Ledger, the implants were hidden within the hardware wallets and operated independently of the device's Secure Element and operating system. This means that while the primary security features of the wallets remained intact, the additional hardware component was able to intercept and exfiltrate sensitive information.
The discovery has led to CryptoBilis suspending sales of the affected wallets, while major competitors Trezor and OneKey have cut ties with the reseller. This incident raises concerns about the security of hardware wallets purchased through third-party sellers and the potential vulnerabilities introduced by unauthorized modifications.
This is not the first time the crypto community has faced issues related to hardware wallet security. In the past, similar incidents have highlighted the importance of verifying the authenticity of devices and purchasing from authorized resellers. The incident also underscores the need for continuous security audits and the potential risks associated with supply chain attacks.
Despite the security concerns, the broader crypto market remains relatively stable. The total market capitalization stands at $2.86 trillion, with 
Bitcoin experiencing a modest 0.45% decline over the past 24 hours. The Fear & Greed Index currently sits at 62, indicating a 'Greed' sentiment among investors.
Ledger Warns of LTE Implants in CryptoBilis Wallets Stealing — questions & answers
How were the seed phrases stolen?
Unauthorized LTE implants in CryptoBilis wallets captured 24-word recovery phrases and transmitted them via cellular networks.
Was the Ledger Secure Element compromised?
No, Ledger states that the Secure Element and operating system remained uncompromised in affected devices.
What actions have been taken in response?
CryptoBilis has halted sales, while Trezor and OneKey have ended their relationships with the reseller.
Which outlets reported this story?
This is an original TLT brief that synthesises reporting from Bitcoin World, Unchained, Cointelegraph, with the key figures cross-checked for agreement across them. It is not a copy of any one article — follow the source links above for the original reporting.
Original summary — not financial advice. This is an original TLT brief that summarises a development reported elsewhere and adds live market data for context; it is not the original article and reproduces no part of it. Follow the source link above for full details. Crypto is volatile and high-risk — always do your own research.