theblock.coarticleLedger confirms hardware implant in CryptoBilis reseller units as MediaMarkt suspends sales in Europe
Ledger's Donjon team confirmed that Ledger signers sold by the reseller CryptoBilis contain an unauthorized implant. It captures the 24-word recovery phrase during setup and sends it over LTE using a provisioned eSIM. It does not touch the Secure Element, the OS, or transaction signing. Onchain researchers estimate losses above $86M, but Ledger says that figure is unverified. MediaMarkt Saturn halted European Ledger sales after a tampered unit was reported in Germany, and Trezor and OneKey tightened or revoked reseller authorizations. The case shows a reseller-channel tampering risk for hardware wallets.
TL;DR Ledger confirms LTE/eSIM implants in CryptoBilis-resold signers that exfiltrate seed phrases; MediaMarkt halts sales, Trezor and OneKey cut resellers.
Organisations named here
- Mark Karpelès
- MediaMarkt Saturn
- recovery phrase exfiltration
Technologies named here
- Ledger hardware signers sold by CryptoBilis
- Ledger Donjon
- Ledger Flex purchased at Singapore's airport
- Ledger
- Trezor
- OneKey
Threat actors named here
- CryptoBilis
Related in Blockchain
blog.thorchain.orgwriteupTHORChain Exploit Report #2 — GG20 root-cause disclosure
protos.comarticleBlack Thursday revisited: MakerDAO keeper exploited for $500K
.jpg)
aikido.devwriteupGraphalgo campaign spreads to Terraform providers and Go Modules
sundaytimes.lkarticle