Ledger investigates hardware wallet implant losses

TLDR

Ledger is investigating a supply chain attack where tampered hardware wallets with hidden cellular implants stole recovery phrases and drained user funds.

1. Ledger found LTE enabled implants in wallets sold by reseller CryptoBilis that captured 24 word recovery phrases and sent them to attackers, with unconfirmed losses near $100 million.
2. The incident appears limited to physically modified devices from that reseller and did not compromise Ledgers secure element, operating system or transaction signing.
3. Ledger is urging potentially affected users to stop using suspect devices, migrate funds to new wallets with fresh recovery phrases, and favor direct or trusted purchase channels.

Deep Dive

1. What Happened In The Implant Case

Ledgers Donjon security team reported that some devices sold via Southeast Asian reseller CryptoBilis contained a hidden hardware implant inside the casing that watched the screen during setup.

According to Ledgers update, the implant used a microcontroller to read the 24 word recovery phrase as it appeared, then transmitted the words over LTE using an embedded SIM, effectively exfiltrating the wallets master key without touching the secure element or firmware. This mechanism is described as a physical supply chain attack in several reports, including a detailed account of the spy chip in reseller sold wallets.

On chain investigators have estimated that more than 300 wallets may have lost assets, with various analyses placing suspected losses in the 86 to 103 million dollar range, though Ledger has not confirmed a final total and warns that third party figures remain unverified.

Confidence: high because multiple independent news and analysis outlets report consistent technical details and an official Ledger investigation is ongoing.

2. Scope Of The Breach And Hardware Wallet Risk

So far, Ledger says every confirmed loss it has verified involves devices purchased through CryptoBilis, and that there is no evidence of compromise in its own manufacturing infrastructure, internal systems or direct sales channels. A CoinsKid community summary of malicious implants in CryptoBilis wallets stresses this distinction.

This makes the incident a classic supply chain problem rather than a break in Ledgers core cryptography. The implant sat alongside the legitimate electronics, leaving the secure element and transaction signatures intact while leaking the recovery phrase. Other hardware vendors reacted by dropping CryptoBilis as a reseller and offering replacements, underscoring that the weak point was the reseller path, not the concept of offline key storage itself.

3. Practical Takeaways For Hardware Wallet Users

Ledger has advised customers who bought a device through CryptoBilis and have not initialized it to avoid setting it up and to contact support. Users who already initialized such a device are told to move funds to a new signer created with a completely new recovery phrase, as described in their hidden chips stole recovery phrases update.

For broader users, several practical patterns emerge from this incident:

1. Prefer buying hardware wallets directly from the manufacturer or clearly verified official channels, rather than gray market resellers.
2. Treat the 24 word phrase as the single crown jewel, never typed on a computer, phone or camera exposed surface, and never shared with anyone claiming to be support.
3. Be cautious of devices that appear opened, modified or re shrink wrapped, and consider contacting the vendor before using anything that seems physically altered.

Conclusion

Ledgers investigation points to a sophisticated but very specific supply chain compromise that abused a spy implant to leak recovery phrases from modified devices, rather than a systemic break in its hardware or software design.

For crypto users, the main lesson is that self custody security depends not only on strong cryptography, but also on trusted hardware distribution paths and disciplined handling of recovery phrases, which are the ultimate keys to your funds.