Ledger wallets sold through CryptoBilis carried a recovery-phrase-stealing implant

Ledger hardware wallets sold through the retailer CryptoBilis were found carrying an unauthorized LTE implant that transmitted owners' recovery phrases over eSIM while the devices were being set up. Ledger has suspended the retailer's sales across Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong, and MediaMarkt has pulled the units from sale in Europe.

Anyone who bought a device through the affected channels should treat its recovery phrase as compromised and move funds to a wallet generated on a clean device. Loss figures circulating online are unverified.

Sources: BleepingComputer, CoinDesk, CoinCentral