Ledger has detailed how LTE-enabled implants hidden inside hardware wallets could expose users' recovery phrases. The disclosure prompted CryptoBilis to halt sales of wallets containing the spy implants. Trezor and OneKey have both cut ties with the reseller.
What the implants do
The implants use LTE connectivity to quietly transmit wallet recovery phrases once a device is set up and funded. Ledger's writeup explains that the compromised hardware looks and behaves like a normal wallet until it's activated. That recovery phrase is the single point of failure for any self-custody setup, so a silent exfiltration path is about as bad as it gets.
CryptoBilis, which sold the affected devices, stopped selling wallets with the implants after Ledger's disclosure. The reseller hasn't said publicly how many units reached customers or where the modified hardware originated.
Trezor and OneKey walk away
Trezor and OneKey both ended their relationships with CryptoBilis. Neither vendor has published a statement on the decision beyond the tie-up itself. The move leaves CryptoBilis without two major brand partners, at least for now.
That's a fast response. Reseller agreements don't usually get torn up the same week a security report lands, especially when the reseller hasn't been accused of building the implants itself. But when the product category is hardware wallets — where the entire pitch is that your keys never touch the internet — a reseller caught shipping LTE radios inside the casing is a reputational problem no partner wants to sit next to.
Where the devices came from
What's still unclear is how the implants got into the supply chain. Ledger's report describes the LTE hardware but doesn't name a manufacturer or a country of origin. CryptoBilis hasn't addressed whether the units were tampered with before or after they reached its inventory. Until someone answers that, every reseller in the hardware wallet space has an open question on its hands: can you prove the device in the box is the device that left the factory?
For users who bought a wallet through CryptoBilis, the practical advice is simple and unpleasant — treat any recovery phrase entered on that device as exposed. Moving funds to a freshly generated seed on hardware from a vendor with no connection to the reseller is the standard cleanup, though none of the companies involved has issued formal guidance yet.
The reseller problem
Hardware wallet makers have spent years telling customers to buy direct or from authorized partners. CryptoBilis was one of those partners for Trezor and OneKey until this week. That's the uncomfortable part of the story: the tampering didn't happen in a dark alley, it happened inside the channel the vendors themselves pointed customers toward.
Neither Trezor nor OneKey has said whether it will audit other resellers. Ledger hasn't indicated if it plans to publish a fuller technical breakdown. CryptoBilis, for its part, has gone quiet since halting sales — and the question of how many compromised wallets are already in people's drawers doesn't have an answer yet.
