Ledger Warns of LTE Implants in CryptoBilis Wallets Stealing Seed Phrases
Unauthorized hardware modifications in CryptoBilis wallets captured users' recovery phrases and transmitted them via cellular networks.
Unauthorized hardware modifications in CryptoBilis wallets captured users' recovery phrases and transmitted them via cellular networks. This is an original Token Times brief synthesising 2 outlets (Bitcoin World, Unchained), plus live market data, as of Thu, 15 Oct 2026 05:45:01 UTC.
This incident highlights critical vulnerabilities in the hardware wallet supply chain, potentially compromising the security of users' crypto assets and eroding trust in reseller channels.
- Unauthorized LTE chips in CryptoBilis wallets captured 24-word seed phrases.
- The implants transmitted data via cellular networks without affecting the Secure Element.
- Affected devices were traced to a Southeast Asian reseller.
- Incident raises concerns about hardware wallet supply chain security.
Multiple outlets, including BitcoinWorld, Unchained, and Decrypt, confirm that Ledger discovered unauthorized LTE chips in hardware wallets sold by Southeast Asian reseller CryptoBilis. These chips captured users' 24-word recovery phrases during setup and transmitted them via cellular networks. However, there is a discrepancy in how the data was captured: BitcoinWorld suggests the chip intercepted the phrase internally, while Decrypt claims it read the phrase off the screen. All outlets agree that the Secure Element and wallet's operating system remained uncompromised.
Ledger has issued a security alert after discovering unauthorized LTE chips embedded in hardware wallets sold by Southeast Asian reseller CryptoBilis. These implants were designed to capture users' 24-word recovery phrases and transmit them over cellular networks, according to multiple outlets including BitcoinWorld, Unchained, and Decrypt.
The compromised devices were traced back to CryptoBilis, a reseller in the region. The implants were found to be add-on components that did not affect the Secure Element or the wallet's operating system, as confirmed by Ledger. This means the core security features of the hardware wallets remained intact, but the recovery phrases were still compromised during the setup process.
There is some discrepancy in how the data was captured. BitcoinWorld suggests that the LTE chip intercepted the recovery phrase internally, while Decrypt claims it read the phrase directly off the device's screen during the setup process. Despite this difference, all outlets agree that the Secure Element, which is the primary security component, was not breached.
This incident raises significant concerns about the security of the hardware wallet supply chain. While the Secure Element remained secure, the fact that unauthorized components could be added to the devices during the manufacturing or distribution process is alarming. It underscores the importance of verifying the authenticity of hardware wallets and purchasing them from trusted sources.
The broader crypto market remains in a state of cautious optimism, with a total market cap of $2.78 trillion. However, 
Bitcoin has experienced a 24-hour decline of 3.32%, and the Fear & Greed Index stands at 53, indicating a neutral sentiment. This incident could further impact market sentiment, particularly among users who rely on hardware wallets for security.
Ledger Warns of LTE Implants in CryptoBilis Wallets Stealing — questions & answers
How were the seed phrases stolen?
The LTE implants captured the 24-word recovery phrases either by intercepting them internally or reading them off the screen during setup.
Were the Secure Elements compromised?
No, the Secure Elements and operating systems of the wallets were not affected by the implants.
Which reseller sold the compromised wallets?
The affected devices were sold by CryptoBilis, a Southeast Asian reseller.
Which outlets reported this story?
This is an original Token Times brief that synthesises reporting from Bitcoin World, Unchained, with the key figures cross-checked for agreement across them. It is not a copy of any one article — follow the source links above for the original reporting.
Original summary — not financial advice. This is an original Token Times brief that summarises a development reported elsewhere and adds live market data for context; it is not the original article and reproduces no part of it. Follow the source link above for full details. Crypto is volatile and high-risk — always do your own research.