Ledger Stax vs Trezor Model One

On 9 October 2026 Ledger began investigating fund losses reported by people who had bought devices from CryptoBilis, a Southeast Asian reseller, and asked the reseller to stop selling and shipping them. On 13 October Ledger’s Donjon security team described what it found inside an affected device: a separate circuit hidden in the enclosure that read the recovery phrase off the screen during setup and sent it out over LTE through an eSIM.

According to Ledger, the implant did not modify the Secure Element, the operating system, transactions or signatures, and there is no indication that Ledger’s own systems were compromised. Ledger’s support documentation notes that Genuine Check cannot detect an added component when the original Secure Element is intact. Every confirmed loss involved a device sold by CryptoBilis; Ledger said it was still examining reports of implants in devices bought elsewhere. MediaMarkt Saturn suspended Ledger sales in Europe after a customer in Germany reported a tampered unit. On-chain researchers estimated losses above $86 million; Ledger has not verified that figure.

In its statement of 15 October Ledger called the incident a localized distribution attack rather than a systemic supply-chain attack. It asked its authorized resellers and distributors to suspend sales in Southeast Asia and Hong Kong, and said every device it bought and opened in stores to check, including in Germany, was clean. Ledger has not published how many devices or users were affected; it says devices returned by buyers may never be resold and will publish more details later.

If you are buying or already own a Ledger device:

• Buy from Ledger directly or from a reseller on Ledger’s authorized list.
• Do not set up a device bought from CryptoBilis. If you already did, Ledger advises moving your assets to a new device with a newly generated recovery phrase.
• If you lost funds, Ledger asks you to contact law enforcement before opening the device.

The incident concerns how devices reached buyers, not the device design, so it does not change our ratings. We will update this notice as Ledger publishes its findings.

On 28 October 2026 Trezor received a report from a buyer in Indonesia of an extra circuit board inside a Trezor Safe 5 bought in August 2026 from CryptoBilis, the same Southeast Asian reseller whose Ledger devices carried hardware implants. According to the report, the board sits between the main board and the screen, reads what the screen shows, including the recovery phrase, and sends it out over a mobile network. Trezor has not yet examined the device, calls the report credible and is having the unit sent to its lab.

Trezor says it has no reports involving any other reseller and no evidence that any customer has lost funds; the person who reported the implant had already moved their funds. Trezor removed CryptoBilis from its authorized resellers on 9 October 2026.

Trezor’s advice applies to every Trezor model bought from CryptoBilis from March 2026 onwards:

• If the device is not set up yet, do not set it up and never enter an existing recovery phrase on it.
• If you already use it, move your funds as soon as possible to a new wallet with a newly generated recovery phrase. Restoring the old phrase on another device does not help.
• Keep the device and contact Trezor Support: affected buyers can get a new device or a voucher. Do not open it; Trezor says weighing it is not a reliable test.

The report concerns how one device reached a buyer, not the device design, so it does not change our ratings. We will update this notice when Trezor publishes the result of its examination.