Ledger has verified that a physical modification embedded inside signers distributed by Southeast Asian vendor CryptoBilis records the 24-word recovery passphrase during initial setup and broadcasts it via an integrated eSIM over LTE networks.
The Donjon cybersecurity division of the firm stated on Tuesday via an X post that this modification leaves the hardware’s Secure Element, the native Ledger operating system, and transaction signing processes completely untouched.
Ledger’s disclosure follows statements made the prior week regarding its investigation into stolen funds reported by customers who acquired devices through CryptoBilis. Blockchain investigators previously calculated total losses exceeding $86 million across Bitcoin, Ethereum, and Tron assets.
Nonetheless, Ledger pointed out that the aggregate sum remains unconfirmed, alongside the precise user count impacted.
The update stated that data points spreading across the internet originate from outside entities and have not been fully validated by Ledger, advising victims to connect with law enforcement prior to tampering with their signers.
Ledger reconfirmed that no signs point to a breach within its own infrastructure, networks, or operational services. Furthermore, the company requested that CryptoBilis halt all product sales and dispatches while its security specialists analyze retrieved hardware units.
MediaMarkt halts Ledger sales as the security breach expands
In a related development, MediaMarkt Saturn ceased retail and online distribution of Ledger merchandise starting October 13 following a German buyer’s discovery of a physical modification. Ledger noted that no asset theft occurred in that specific instance.
A representative for MediaMarkt Saturn informed The Block that the firm treats these events with utmost seriousness, confirming that the MediaMarktSaturn Retail Group pulled every impacted item from its physical and digital storefronts while maintaining communication with the manufacturer.
Last Friday, an X participant named Johannes mentioned purchasing two Ledger units from distinct MediaMarkt locations and discovering unauthorized wiring and cellular chips inside both items, though those assertions lack independent confirmation.
Additionally, former Mt. Gox head Mark Karpelès reported on Tuesday that a Ledger Flex acquired at the Changi Airport in Singapore featured a surveillance chip. Ledger directed users back to its CryptoBilis inquiry status report without verifying whether the Singapore unit connected to the broader breach.
Trezor tightens distributor oversight while OneKey provides swap units
This security crisis has prompted other hardware wallet manufacturers to review their sales channels. Trezor announced zero reports of compromised hardware originating from CryptoBilis and no signs that its own inventory was touched, yet it removed the distributor from its partner directory as a precautionary measure.
As outlined in a communication sent to associates by Chief Commercial Officer Danny Sanders, the organization is also scaling back its broader third-party vendor network. Approved vendors identified in the strategy will lose official status on January 1, 2027, and will stop receiving fresh shipments from Trezor, though they are permitted to clear existing stock until that deadline.
Sanders emphasized that zero proof exists indicating Trezor merchandise experienced interference, characterizing the measure as a preventive precaution driven by absolute prudence.
Meanwhile, OneKey confirmed zero customer asset losses tied to the event. The company revoked CryptoBilis as an approved seller and initiated an audit of its entire partner network, noting that vendors tied to questionable corporate structures will forfeit their distribution privileges.
The business is also supplying complimentary hardware exchanges for OneKey items procured via CryptoBilis between March 1 and October 13, regardless of device edition or activation status.
Originally published at https://www.theblock.co/news/business/2026-10-13-ledger-confirms-hardware-implant-cryptobilis-reseller-units-mediamarkt-suspends-sales-europe-418442.
