MiCA explainer

Hardware Wallet Security 27.10.2026: An Explanation

An explanation for the Baltic and Nordic segment: Ledger CryptoBilis implant incident, Trezor reseller network tightening, the new Ledger Atom device, and ESMA register movement without regional firms.

Toms Ābeltiņš

27 October 20267 min read

Over the past 24-48 hours, there have been no clearly datable new developments in our segment. We offer an explanation of hardware wallet supply chain security: the Ledger CryptoBilis incident, the tightening of Trezor's reseller network, and the new Ledger Atom device, alongside the regional regulatory watchlist.

Tuesday, 27 October 2026. This is an explanatory (Watchlist) format publication, not a daily news report. Over the past 24-48 hours, there have been no clearly datable significant new developments in our segment - crypto exchanges and CASPs, hardware wallets, crypto cards, and tax tools serving the Baltics (LV, LT, EE) and Nordics (FI, SE, NO, DK) - that could honestly be presented as fresh news. Therefore, in today's issue, we offer an in-depth explanation of a dominant ongoing theme in the segment - hardware wallet supply chain security - with precise previous dates and an updated watchlist. All events described below occurred in early and mid-October; we are not repeating them as yesterday's news, but explaining them as industry-important, actively developing context.

What Happened: The Ledger "CryptoBilis" Incident

In early October, Ledger's security team, Donjon, discovered that a hardware implant was hidden in some signature devices sold by the Southeast Asian reseller CryptoBilis. Ledger dates the incident to 9 October, stating that on that day, they instructed CryptoBilis to halt sales and deliveries, and on 10 October, confirmed that at least one affected device contained an unauthorised LTE implant.

According to Ledger's description of its operation, the embedded microcontroller within the device's casing read the 24-word recovery phrase from the screen during wallet setup and transmitted it via the mobile network using an eSIM. Anyone with this phrase can move funds. Ledger emphasises that the implant did not alter the device's Secure Element, operating system, or the transactions themselves, and that there is no indication of compromise to the company's infrastructure or direct sales channels.

In response, Ledger expanded the initial sales halt, which only covered CryptoBilis, and asked resellers and distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to suspend sales and remove devices from shelves. Chief Technology Officer Charles Guillemet stated that the company is reviewing reseller controls and anti-tampering protections. Separately, a tampered Ledger Flex device, reportedly purchased at a retail outlet in Singapore airport, was presented; Ledger has not confirmed a link to previous cases.

Caution must be maintained regarding the extent of losses. Blockchain investigator Specter linked over $86 million in potential theft to the incident (separate media estimates range from $86-93 million, affecting around 315 wallets); Ledger has not independently confirmed this figure, and it remains an estimate that may change as tracking continues.

Trezor's Response: Tightening the Reseller Network

In mid-October, Trezor announced a tightening of its reseller network, citing "recent supply chain incidents." According to the announcement, affected resellers will lose authorisation on 1 January 2027, will not receive new products, and will be removed from authorised lists, but are permitted to sell existing stock during the holiday season. Remaining resellers will be subject to stricter rules regarding device sourcing, storage, and handling.

Trezor simultaneously stated that there is no evidence of its devices being compromised and distanced itself from competitive opportunism, publicly emphasising that it is not using a competitor's incident for marketing purposes. The practical implication for regional users is structural, not immediate: both major hardware wallet manufacturers are reviewing how the path from factory to buyer is controlled following the incident.

Ledger Atom: A Design Response for the "Post-Tampering" Era

On 15 October, at the Op3n 2026 event, Ledger unveiled a new device, Atom - a smartphone-like signature device that the company positions as being built for an era of security incidents. The Founders Edition reservation price is $849 (with a fully refundable $100 deposit), with a stated price of $899 after launch.

Its architecture features a separation between the regular and secure environments: an Android Open Source Project (AOSP) operating system runs on the main processor, while Ledger OS runs on a separate secure chip; an FPGA chip controlled by Ledger OS switches the screen to "secure mode" when confirmation is required. The device features a claimed anti-tampering "active shield" and a hardware privacy switch that cuts power to the camera and microphone. The device is for data transmission only (4G/5G data, no calls, SMS, or emergency calls). Solana Mobile has been named as the first hardware expansion partner, and the Seeker app will be pre-installed.

Two limitations are important for Baltic and Nordic buyers: the device is still under development, with delivery planned for summer 2027 (estimated Q2 2027) and dependent on certification, including US FCC; availability in the European Economic Area has not been officially specified. Therefore, for now, it is a design direction, not a real product on regional shelves.

What This Means for Baltic and Nordic Buyers

To date, there have been no reports of Baltic or Nordic resellers being affected by the CryptoBilis incident - documented cases are concentrated in Southeast Asia. The only publicly mentioned European example is in Germany, where retailer MediaMarkt Saturn, with Ledger's consent, stopped selling Ledger devices after a German customer reported an implant; no loss of funds was recorded.

The practical conclusion for the region remains unchanged and classic: for hardware wallet purchases, use the manufacturer's official store or an approved reseller, avoid devices of unclear origin (used, "bargain" offers on third-party marketplaces or from unofficial channels), check the integrity of the packaging, and generate a new recovery phrase on the device, never using a pre-prepared or printed phrase. The risk in this incident is tied to the physical supply chain, not to any specific Baltic or Nordic platform or regulatory loophole.

Watchlist: Regulation and the Regional CASP Landscape

ESMA's MiCA register movement is the most important structural indicator for our segment, and there have been no regional developments in recent weeks. In the 16 October update (more widely reported on 19 October), nine CASPs were added to the register, bringing the total to 375; the added companies were from Germany, Spain, Italy, and Austria, none from the Baltics or Nordics. Denmark's Penning Financial Services briefly disappeared from the 16 October update due to a technical error and was restored in the next update. According to publicly available register tracker data around 23 October, the total number has increased to approximately 384 CASPs, adding primarily German entities; again, no regional firms in this round. We take this last figure with a caveat, as the dates from individual trackers are contradictory, and we await official ESMA register confirmation.

Background context (not fresh news): according to industry media Kaupr's estimate in early July 2026, there were approximately 38 MiCA-authorised companies in the region. Latvia was the most active by the end of June with nine approved companies; Estonia's first independent licence was granted on 1 July; in Norway, several local players received licences (Firi, TÝR Markets, K33, NBX, Bare Bitcoin); in Sweden, only Safello had been licensed for a long time; Finland reviewed its applications by the end of 2025. We keep these figures as background, not this week's data.

Next Checkpoints

Monitor the next weekly ESMA register update and whether any Baltic or Nordic CASPs appear - that would be direct news for the region. Observe whether Ledger publishes additional data on the scale of the CryptoBilis incident and whether any European, especially regional, reseller cases emerge. Follow the implementation of Trezor's reseller policy before 1 January 2027, and whether other manufacturers (BitBox, Coldcard, Tangem) adopt similar supply chain measures. Finally, monitor Ledger Atom's certification and EEA availability announcements, which are currently unknown.

Norriwire Briefing