Ledger is investigating reports of hardware implants found in devices sold through the reseller CryptoBilis and has asked the distributor to stop sales. The company confirmed that verified losses recorded up to October 13 were linked to equipment sold through that channel, putting fresh pressure on the wider hardware wallet industry over how devices reach European buyers before they ever touch a customer's hands.
The response from competing manufacturers has not been uniform. OneKey revoked CryptoBilis's authorization outright, suspended onboarding of any new distributors while it reviews existing partners, and is offering free replacements. Buyers who purchased OneKey devices through CryptoBilis between March 1 and October 12, 2026 can request a replacement until December 31.
Trezor has taken a more gradual route. The company said it will reduce its reseller network and strengthen distribution controls, with authorizations for affected resellers ending on January 1, 2027. In the meantime, Trezor will stop supplying new equipment to those partners and is introducing stricter requirements on how resellers obtain, store and handle devices before sale. Trezor said it has no evidence that its own equipment has been compromised.
Tangem chose transparency over distribution changes, publishing an analysis of the incident that walks through its card architecture and the mechanisms it uses to verify authenticity. The company points to its cards having no screen, battery or USB port, and to a configuration that allows key generation without ever displaying a recovery phrase, as design choices that limit the kind of tampering reported elsewhere.
SafePal's current reseller directory no longer lists CryptoBilis, though the company has issued no statement explaining the change. No public announcement of new measures has surfaced from imKey.
Tampering beyond a single reseller
The CryptoBilis case is not the only recent evidence that compromised hardware wallets are reaching buyers outside tightly controlled channels. A user identified as @0xJohannes_ reported finding a tampered device purchased at a MediaMarkt store in Europe, a retail chain with no connection to CryptoBilis. Separately, Mark Karpelès published findings of an implant discovered in a Ledger Flex bought at Singapore airport. Kaspersky has also documented a counterfeit Trezor Model T unit built with modified components and altered firmware.
For buyers in Europe, the pattern points to a practical takeaway rather than a verdict on any single brand or retailer: devices should be purchased only through manufacturers' official stores or explicitly authorized resellers, packaging and tamper-evident seals should be checked on arrival, and firmware authenticity should be verified through the vendor's own app before any funds are transferred to the device. Manufacturers' own measures, from OneKey's replacement programme to Trezor's reseller wind-down, are being rolled out on different timelines, leaving a transition period during which caution at the point of purchase remains the most direct safeguard available to consumers.
