CryptoBilis wallet thefts: Ledger confirms hardware implant; Trezor Safe 5 tampering suspected
Ledger wallets sold through CryptoBilis contained cryptocurrency-stealing implants; one Trezor Safe 5 is also suspected. Affected buyers should move funds to a trusted, newly created wallet with a new recovery phrase. Reusing the old phrase leaves funds exposed.
If you bought a Ledger from CryptoBilis, or any Trezor supplied by CryptoBilis from March 2026 onwards, do not set up an unused device or enter an existing recovery phrase into it. If already using one, move funds to a new wallet created on a trusted device with a new recovery phrase; restoring the old phrase on replacement hardware does not protect the funds. Contact the maker through its official website for help and never share your recovery phrase; eligible Trezor buyers can request a replacement or voucher.
What’s happening
Cryptocurrency thefts involving Ledger wallets bought through Southeast Asian reseller CryptoBilis exposed physical tampering with genuine devices. Ledger confirmed an added component that copied recovery words from the display during setup and sent them over a mobile network, allowing attackers to access the funds elsewhere. Ledger said its Secure Element, operating system and internal systems were not compromised. The exact point of tampering remained unknown. Trezor subsequently warned about one suspected Safe 5 bought through CryptoBilis, but had not examined it and had received no reports of losses from CryptoBilis buyers. Its precautions cover every Trezor model supplied by that reseller from March 2026 onwards. This requires moving funds to a newly created wallet, rather than a software patch. Trezor offers replacement hardware or vouchers. As of 3 November, the reviewed sources establish neither a final theft total nor an amount repaid to victims; frozen tokens are not confirmed recoveries.
- What
- Poisoned software
- Affects
- Ledger hardware wallets and Trezor hardware wallets supplied by CryptoBilis
- Affected
- Ledger hardware wallets sold through CryptoBilis: confirmed physical tampering; Ledger had not published a complete affected model or batch list.
Trezor Safe 5: one suspected implant, awaiting examination.
Precautionary guidance covers every Trezor model supplied by CryptoBilis from March 2026 onwards, including through other shops and marketplaces. - Fixed in
- Nothing to patch
- Since
- 9 Oct 2026
Timeline
- Update
Crypto.news reported overlapping theft estimates of US$95.35 million from Arkham and US$102 million from Bitquery, neither confirmed by Ledger as the final total. Researchers reported roughly US$10 million in USDT frozen, which did not establish repayment to victims.
- Vendor revised
Trezor disclosed a suspected Safe 5 implant reported on 28 October, pending examination, with no reported fund losses. It urged buyers of every Trezor model supplied by CryptoBilis since March 2026 to move funds and offered replacements or vouchers.
- Update
Singapore police reported at least two cases involving tampered Ledger wallets since 10 September, with about S$3.5 million lost. Their advisory did not name CryptoBilis and said investigations were continuing.
- Vendor revised
Ledger explained that the implant captured recovery words displayed during setup and transmitted them over a mobile network. It said the added hardware left the Secure Element, operating system and transaction signatures unchanged; where the tampering occurred remained under investigation.
- Vendor revised
Ledger said all confirmed losses in the disclosed incident involved CryptoBilis purchases and described the number of affected devices as limited. It said its own systems and direct sales channels remained unaffected.
- Update
Ledger confirmed an unauthorised hardware implant inside at least one affected customer's device and said it was working with authorities.
- Made publicNothing to patch
Ledger began investigating cryptocurrency losses involving wallets bought through CryptoBilis and asked the reseller to stop sales and shipments. Trezor removed CryptoBilis from its authorised reseller network the same day.
Sources
- Implant reported in a Trezor sold by CryptoBilisTrezor · 30 Oct 2026
- Police Advisory On Tampered Cryptocurrency Hardware WalletsSingapore Police Force · 28 Oct 2026
- Ledger confirms spy chip implant behind wallet crypto theftsBleepingComputer · 12 Oct 2026
- Ledger says 'spy' chip inside CryptoBilis Ledger devices transmitted wallet keys over mobile networkCoinDesk · 13 Oct 2026
- Trezor warns of suspected crypto-theft implant in hardware walletBleepingComputer · 30 Oct 2026
- A secure wallet, a compromised seller: What CryptoBilis exposedcrypto.news · 2 Nov 2026