Ledger reseller probe finds implanted hardware wallet

TLDR

Investigators confirmed that at least one Ledger hardware wallet sold via a reseller contained a hidden spy implant that enabled large multi chain thefts.

1. Ledger found an unauthorized hardware implant in a customer device tied to losses, mainly in units sold by Southeast Asian reseller CryptoBilis, while saying its own systems and direct sales were unaffected.
2. Independent analyses estimate about $72 million to $93 million stolen across Bitcoin, Ethereum, Tron and stablecoins by implants that captured 24 word recovery phrases and sent them over cellular networks.
3. Users who bought from affected channels are being told not to initialize unused devices and to migrate funds to a new wallet with a fresh recovery phrase, ideally bought directly from the manufacturer.

Deep Dive

1. What Investigators Actually Found

Ledger examined a drained customer device and confirmed an extra electronic module, calling it an unauthorized hardware implant, in wallets sold via authorized reseller CryptoBilis in Southeast Asia. Reports note that legitimate devices were physically modified while shrink wrap and branding remained intact, raising direct supply chain concerns for hardware wallets purchased from intermediaries. Ledger states that the number of confirmed cases appears limited and that its security infrastructure and direct sales channels have not been compromised, while CryptoBilis has suspended all hardware wallet sales pending investigation.

Separate coverage describes a possible similar spy implant reported in a device bought from an official European reseller, but this European case remains unconfirmed and unlinked to the CryptoBilis cluster.

2. Scale Of Losses And How The Attack Worked

Multiple analyses estimate that attackers drained roughly $72 million to more than $90 million in crypto, with one investigation citing about $93.2 million across hundreds of wallets on several chains including Bitcoin, Ethereum, Tron and stablecoins such as USDT and USDC, all linked to customers who bought from the reseller. Investigators describe implants as small circuit boards hidden behind the display, with a microcontroller plus LTE cellular hardware that monitors the screen, reconstructs the 24 word recovery phrase during setup and then exfiltrates it via mobile networks. Once an attacker has that phrase, they can restore the same wallet elsewhere and empty funds without further interaction from the victim.

Estimates vary by dataset, but all agree that this was a targeted, physical tampering attack on specific supply channels rather than a remote compromise of Ledgers core firmware or secure element.

3. Practical Risk Mitigation For Hardware Wallet Users

For users, the key risk is not that Ledger devices are universally backdoored, but that hardware bought from the wrong place can be physically altered in ways normal authenticity checks do not detect. Ledger is advising buyers who obtained devices from CryptoBilis not to initialize unused units, and those who already did so to move funds to a new device using a brand new recovery phrase created on that trusted unit. More generally, users can reduce similar supply chain risk by buying hardware wallets directly from the vendor or from tightly controlled, well documented channels, by inspecting devices for signs of tampering and by treating any device that arrives pre initialized, with a printed seed or unsolicited in the mail as compromised.

Conclusion

This incident shows that even reputable hardware wallets can be undermined when attackers compromise resellers and physically alter devices to exfiltrate seed phrases. The core cryptography may remain intact, yet the supply chain becomes the weakest link. Going forward, the main protections for crypto users are careful control over where devices are sourced, strict hygiene around recovery phrases and a willingness to rotate to new wallets with fresh seeds whenever a devices integrity is in doubt.