Ledger confirms hardware implant in reseller wallets

TLDR

Ledger has confirmed that some hardware wallets sold through Southeast Asian reseller CryptoBilis were physically tampered with to steal recovery phrases, in a major hardware supply chain attack.

1. Ledgers security team found a covert LTE implant in at least one CryptoBilis-sold device that captured the 24-word recovery phrase during setup and sent it to attackers.
2. All confirmed losses so far involve CryptoBilis devices; onchain estimates near 86 to 100 million dollars are unverified, while other retailers have suspended Ledger sales pending checks.
3. Users who bought Ledger devices from CryptoBilis or questionable resellers should avoid initializing them and migrate funds from any used device to a new wallet with a fresh recovery phrase.

Deep Dive

1. How The Implant Worked

Ledgers Donjon security team confirmed that a hidden circuit board inside some devices sold by CryptoBilis could read the screen as the 24-word recovery phrase appeared, decode it, and transmit it over LTE via a provisioned eSIM during setup, effectively stealing the wallets master key without changing normal operation. This was described as a physical supply chain attack that did not alter the Secure Element, Ledgers operating system, or the transaction signing process, meaning software and cryptography remained intact even while the secret was exfiltrated from the screen itself, as detailed in Ledgers investigation update and reporting by CoinDesk and Decrypt.

2. Scope, Losses, And Supply Chain Risk

Ledger says every confirmed loss in the October incident involved devices distributed by CryptoBilis in Southeast Asia and that it has no evidence of compromise in its own manufacturing infrastructure or direct sales channels, while CryptoBilis has paused Ledger sales. Onchain investigators and analytics firms have estimated suspected thefts at roughly 86 to 100 million dollars across hundreds of wallets, but Ledger explicitly warns that these figures and victim counts remain unverified, as noted in analysis by Crypto.news. Separately, MediaMarkt Saturn has suspended Ledger sales across Europe after a customer reported a tampered device, and security firm Darkfost has flagged concern about airport vending machines and other retail channels, expanding the perceived risk list for resellers, according to TokenPost.

3. Practical Steps For Users

Ledger advises customers who bought devices through CryptoBilis but have not initialized them not to set them up and to contact support, while anyone who already used such a device should promptly transfer funds to a new wallet generated on a trusted device with a completely new recovery phrase, never reusing exposed words, guidance echoed in multiple incident summaries like TokenPosts overview. Users who suspect tampering are urged to coordinate with local law enforcement and Ledger support before opening or shipping devices, since the hardware can be evidence. More broadly, crypto users should prefer buying hardware wallets directly from manufacturers or well vetted channels, be wary of unsolicited devices or physical letters, and remember that no legitimate provider will ever ask for a recovery phrase on a website or via mail.

Conclusion

This incident shows that even reputable hardware wallets can be undermined when the supply chain is compromised, shifting risk from software exploits to physical distribution channels. For crypto holders, the key defenses are controlling where devices come from, treating recovery phrases as strictly offline secrets, and staying attentive to official security advisories and reseller status updates.