According to Cointelegraph, Ledger disclosed that hardware wallets sold by CryptoBilis were implanted with an LTE spy module, escalating the risk of seed phrase leakage. The incident is a hardware wallet supply chain attack, with Ledger, Trezor, and OneKey all included in the affected scope, significantly raising concerns about the asset security of hardware wallet users.
Based on disclosed information, the incident is a hardware wallet supply chain attack, with the core risk pointing to seed phrase leakage. The named sales channel is CryptoBilis, whose sold wallet products were found to contain an implanted LTE spy module. The affected scope is not limited to a single brand; all three hardware wallet manufacturers—Ledger, Trezor, and OneKey—are on the affected list. Publicly available material currently confirms the above entities, channel, attack vector, and brand scope, but the specific number of affected devices, batches, financial amounts involved, and the identity of the attacker have not yet been disclosed.
CryptoBilis is the sales channel named in this incident. This information indicates that when users purchase hardware wallets through third-party channels, they need to pay attention to the source of sale and device integrity. For hardware wallet manufacturers, the issue of security boundaries around third-party sales channels has therefore drawn attention. However, the specific point of implantation in this incident, attribution of responsibility, and the supply relationships between the brands and CryptoBilis have not yet been explained in the material.
For this incident, publicly available material only confirms that the sales channel is CryptoBilis and that an LTE spy module was implanted; it does not further specify the exact stage, transportation route, or method of tampering. Therefore, beyond what has been disclosed, no extended judgment can currently be made about specific stages such as production, distribution, or logistics. This means that exactly at which node in the supply chain the attack occurred still awaits further disclosure by relevant parties.
Information that can currently be confirmed includes: the incident was disclosed by Ledger, the sales channel is CryptoBilis, the implanted module type is LTE, the affected brands include Ledger, Trezor, and OneKey, the risk points to seed phrase leakage, and concern over user asset security is high. Beyond this scope, there is currently no public explanation for matters such as the specific implantation method, the attacker's behavioral path, the difficulty of device detection, or the distribution of weak links in the supply chain.
If seed phrases are leaked, users' on-chain assets may be put at risk. This is one of the direct reasons why concern over user asset security has risen significantly after the disclosure of this incident. As of now, the material has not disclosed whether the seed phrases have actually leaked, nor whether the attacker has already obtained complete control conditions. As for the scope of impact itself, existing information only makes clear that Ledger, Trezor, and OneKey are all affected, but does not specify the specific affected batches or device models for each brand.
Based on existing material, market attention is focused on three aspects: first, the specific scope and batches of affected devices; second, whether seed phrases have actually leaked; and third, how users should handle devices already purchased or in transit. These three questions currently have no specific answers in the material. It should be made clear that the material has not disclosed the specific number of affected devices, the amounts involved, or the identity of the attacker, and relevant information still awaits further confirmation.
At this stage, what can be confirmed is the entity involved in the incident, the sales channel involved, the attack vector, and the scope of affected brands; what cannot yet be confirmed is the scale of the leak and actual losses. Directions worth tracking going forward include: whether Ledger, Trezor, and OneKey issue official statements and handling guidance for this incident; what measures CryptoBilis will take as the sales channel; and whether relevant manufacturers will further disclose device batches, risk identification methods, and follow-up response plans. For users holding relevant devices, promptly following notifications from manufacturers' official channels is a direct basis for assessing their own risk.
.jpg)
