Ledger confirms hardware implant discovered in CryptoBilis reseller units that exfiltrates seed phrases via LTE; MediaMarkt suspends sales across Europe.
Security & Exploits ·
Ledger's security team has confirmed the discovery of a hardware implant in devices sold through CryptoBilis, a reseller, with MediaMarkt halting sales across Europe in response. According to Ledger's Donjon division, the implant reads seed words displayed on the screen during device setup and transmits them over an LTE connection, bypassing the hardware wallet's offline security model entirely.
The compromised devices appear linked to a suspected $86 million drain of user funds. The implant's presence in Ledger units supplied through at least one authorized reseller represents a supply-chain attack against one of the industry's most widely used hardware wallets, enabling attackers to obtain the full recovery phrases needed to access wallets.
The scope of affected units—how many devices were compromised, which batches or serial numbers, and the full timeline of distribution—has not yet been disclosed. The investigation into whether other resellers or sales channels received implanted devices remains ongoing.