Ledger confirms hardware implant in reseller devices

TLDR

Ledger has confirmed that some hardware wallets sold through a Southeast Asian reseller were physically tampered with to steal recovery phrases during setup.

1. Ledgers security team found unauthorized LTE implants in devices sold via reseller CryptoBilis that capture the 24-word recovery phrase and transmit it over cellular networks.
2. Confirmed losses involve CryptoBilis devices, with third party estimates in the tens of millions of dollars, but Ledger has not verified the total or full number of affected users.
3. Ledger and rival vendors are tightening reseller controls, and some retailers have suspended Ledger sales, highlighting supply chain risk for hardware wallets across the market.

Deep Dive

1. How The Implant Attack Works

Ledgers Donjon security team confirmed that certain signers sold through Southeast Asian reseller CryptoBilis contained an added hardware module that sits inside the case and watches the screen during setup. The implant reads the 24-word recovery phrase as it is displayed and sends it via LTE using a provisioned eSIM, as described in reports on these LTE implants.

Crucially, the implant is a separate component. It does not alter the Secure Element, Ledgers operating system, or transaction signatures, which means normal authenticity checks and firmware verification can still pass even when the device has been physically modified.

2. Scope, Losses And User Risk

Ledger states that all confirmed fund drains in this incident involve devices sold through CryptoBilis in Southeast Asia, and that its own infrastructure and direct sales channels are not implicated in verified cases, according to this incident analysis.

On-chain investigators have estimated suspected thefts in the range of 86 to more than 90 million dollars across Bitcoin, Ethereum and Tron, but Ledger repeatedly notes that these loss figures and victim counts are not fully verified in its public updates and in coverage of the spy implant scandal.

For users, the key risk is any device that may have been modified after manufacturing. If a recovery phrase was ever shown on a compromised screen, moving funds to another address derived from that same phrase would not remove the risk, because the seed itself is known.

3. Wider Hardware Wallet Market Response

The scare has triggered a broader tightening of hardware wallet supply chains. MediaMarkt Saturn has suspended Ledger sales in Europe pending investigations into a tampered unit, and Ledger has asked partners in several Asian markets to pull its devices from shelves during the probe.

Competitors such as Trezor and OneKey are cutting ties with CryptoBilis and shrinking their reseller networks as a precaution, stressing that even technically secure devices can be compromised between factory and customer if handling is not tightly controlled, as noted in Trezors reseller crackdown.

Conclusion

Ledgers confirmation of a hardware implant in reseller devices shows that physical supply chain attacks can bypass normal firmware checks by targeting the recovery phrase itself. The immediate impact is concentrated on CryptoBilis sourced units, but the response from Ledger, retailers and rival vendors highlights that distribution channels are now a critical security frontier for self custody. For crypto users, the practical takeaway is to treat where and how a hardware wallet is sourced as seriously as which brand or model they use, and to watch for further official updates as investigations narrow the scope of affected devices.