CryptoBilis (Organization): news timeline & CVEs

Ledger asks sellers across Asia to halt sales after supply-chain attack

Ledger halted Asia and Hong Kong reseller sales after tampered wallets stole seed phrases over LTE.

Ledger told distributors and resellers in Southeast Asia and Hong Kong to stop selling hardware wallets after confirming supply-chain tampering. Devices from reseller CryptoBilis contained a separate microcontroller implant that decodes the 24-word recovery phrase and transmits it over LTE using an eSIM, without modifying the Secure Element or Ledger OS. Ledger said confirmed fund losses involve CryptoBilis units, while users also reported modified devices from a Singapore airport retailer and MediaMarkt in Europe. Trezor said it found no compromise of its own devices but will end many reseller authorizations on January 1, 2027.

BleepingComputerOct 14, 17:46 UTC · 2d agoData breach in the wild1· 1 read

Who Is Planting Backdoors in Ledger Crypto Wallets?

Hardware implants in Ledger wallets sold by authorized resellers enabled theft of about $102 million.

Ledger said hardware implants in wallets sold by Malaysian reseller CryptoBilis enabled theft of cryptocurrency now valued at about $102 million from roughly 315 accounts, according to Bitquery. Stolen assets included Bitcoin, Ethereum, and Tron. Users and researchers have also reported implants in Ledger Nano X, Flex, and Stax devices, including two Nano X units purchased in person at MediaMarkt stores in Germany. Joe Grand had notified Ledger of similar Nano X implants in March. Ledger said there is no indication its own infrastructure was compromised and told resellers not to restock returned devices.

Hacker News · securityOct 14, 09:37 UTC · 2d agoData breach in the wild 2 sources HN 128↑ · 155 comments1

Risky Bulletin: Spyware chip found in Ledger crypto-wallets

Spy chips in Ledger Nano X wallets sold via CryptoBilis stole seed phrases and over $86 million.

Tibane Labs reported spy chips soldered into Ledger Nano X wallets sold by Southeast Asian reseller CryptoBilis, intercepting on-screen seed phrases and sending them to attackers over a built-in modem and eSIM. Ledger linked the backdoored devices to more than $86 million in stolen crypto and told customers to discard affected wallets and move funds; it paused work with CryptoBilis. Newer implants use a painted flex PCB, and at least one Ledger Flex bought at Singapore Airport was also reported implanted. The same bulletin also covers freezer tampering at French supermarkets including Intermarche, an Ahold Delhaize outage, and a Meta GitHub breach affecting more than 1,500 US employees.

Risky Business NewsOct 14, 03:02 UTC · 3d agoMalware in the wild2· 1 read

Crypto thieves sell hardware wallets with secret eSIM

Tampered Ledger Nano X wallets with hidden LTE modems stole seed phrases, draining about $93 million.

Criminals sold modified Ledger Nano X hardware wallets containing a chip that intercepts seed phrases displayed from the Secure Element, plus an LTE modem, eSIM, and antenna that transmit them. The Secure Element itself was not altered. Blockchain observers identified more than 300 drained wallets totaling about $93 million, with broader loss estimates near $100 million, and some proceeds passed through mixers. Tibane Labs described professionally manufactured implants; Ledger warned customers who bought from Malaysian dealer Cryptobilis in the last three months not to use those devices.

Hacker News · AIOct 13, 08:34 UTC · 3d agoPhishing & fraud in the wild 5 sources HN 110↑ · 2 comments1

Ledger confirms hardware wallet spy implant behind crypto thefts

Ledger confirmed spy implants in CryptoBilis-sold Nano X wallets captured seed phrases and drained users' cryptocurrency.

Ledger confirmed that some hardware wallets sold by Malaysia-based reseller CryptoBilis contained unauthorized spy implants that drained cryptocurrency. Researchers, including Mark Karpelès and Tibane Labs, found Ledger Nano X variants whose implants captured display output and button presses to reconstruct the seed phrase, then sent it over LTE using an eSIM. One design replaced the battery with a smaller cell and an STM32G431KBU6; a more advanced variant fit under the OLED and used a factory flex PCB. Ledger called the affected volume limited, told buyers not to set up those devices or to move funds to a new seed, and said its Genuine Check cannot detect added implants when the Secure Element is intact.

BleepingComputerupdated Oct 13, 08:34 UTC · 3d agofirst Oct 12, 16:27 UTC · 4d agoData breach in the wild 5 sources

Ledger Confirms Unauthorized Hardware Implant in Crypto Wallet Sold by CryptoBilis

Ledger confirmed an unauthorized hardware implant in a CryptoBilis-sold wallet linked to cryptocurrency theft.

Ledger confirmed that one cryptocurrency hardware wallet tied to reported fund losses contained an unauthorized hardware implant. All confirmed cases from an October 9 draining incident involved devices sold by Southeast Asian reseller CryptoBilis, which has stopped hardware-wallet sales. Ledger said the number of affected devices is limited and that its own systems and direct sales were unaffected. A blockchain investigator estimated possible losses above $86 million, a figure Ledger has not confirmed, and the company has not explained how the implant worked.

Cyber Security Newsupdated Oct 13, 08:34 UTC · 3d agofirst Oct 12, 13:10 UTC · 4d agoData breach in the wild 5 sources1

Ledger Finds Unauthorized Hardware Implant in CryptoBilis-Sold Wallet Amid Fund Theft Reports

Ledger found a hardware implant in a CryptoBilis-sold wallet after reports of more than $86 million in stolen crypto.

Ledger paused sales through reseller CryptoBilis after Southeast Asian users reported stolen cryptocurrency totaling more than $86 million, according to investigator Specter. Ledger said one affected device contained an unauthorized hardware implant and that all confirmed cases involve CryptoBilis-sold devices. Buyers from the last 90 days were told not to set up unused devices and to move assets to a new signer with a new seed if already set up. CryptoBilis halted hardware-wallet sales and warned that a pre-printed recovery phrase means the wallet should be treated as unsafe.

The Hacker Newsupdated Oct 13, 08:34 UTC · 3d agofirst Oct 12, 11:21 UTC · 4d agoData breach in the wild 5 sources1· 1 read

Hidden implant in Ledger hardware wallets linked to $93M theft

Hardware implants in Ledger wallets sold via Southeast Asia reseller CryptoBilis drained over $93 million in crypto.

Suspected losses exceed $93 million after Ledger devices sold through Malaysian reseller CryptoBilis were found to contain unauthorized hardware implants, with all confirmed cases tied to that channel. Mark Karpelès documented a hidden circuit board with microcontroller, LTE chip, and e-SIM under the screen that captures the displayed seed phrase and transmits it to attackers. Devices passed Ledger's Genuine Check and arrived in intact shrink wrap; Bitquery data suggests wallets funded since June may be affected, beyond Ledger's 90-day advisory window.

Help Net Securityupdated Oct 13, 08:34 UTC · 3d agofirst Oct 12, 09:46 UTC · 4d agoData breach in the wild 5 sources1· 1 read

CryptoBilis

Timeline8 articles

Appears with