Ledger reports spy-chip risk in hardware wallets

TLDR

Ledger has confirmed that some third?partysold hardware wallets contained LTE-enabled spy chips that can steal recovery phrases, exposing a serious supply?chain risk for self?custody users.

1. The implant sits inside the device, reads the 24-word seed phrase from the screen during setup, and sends it over a mobile network without changing Ledgers software.
2. Confirmed drained wallets so far are tied to devices sold via reseller CryptoBilis, while suspected tampering at other retailers shows the risk extends beyond one seller.
3. The core secure element remains intact, but users should treat provenance, physical tampering and any request for their seed phrase as critical red flags.

Deep Dive

1. How The Spy Chip Steals Keys

Ledgers security team (Ledger Donjon) found an unauthorized hardware implant inside some Ledger signers sold by Southeast Asian reseller CryptoBilis. The component sits in the casing, taps into display signals, and recognizes when the 24-word recovery phrase is shown during setup.

Investigations report that a microcontroller decodes the words and transmits them via LTE using an embedded SIM, allowing attackers to reconstruct the wallet and drain funds, while Ledgers operating system and secure element remain unchanged. This mechanism is described as a physical supply-chain attack, not a hack of Ledgers firmware or back-end systems, in Ledgers public update and independent coverage from outlets such as CoinDesk and Tokenpost, which detail how the covert implant in CryptoBilis devices captured recovery phrases.

On-chain researchers cited in those reports estimate hundreds of affected wallets and tens of millions of dollars in stolen assets, with Tether freezing a portion of the associated USDT.

2. Scope And Supply-Chain Risk

Ledger has said that all confirmed drained wallets in the current incident involve devices sold through CryptoBilis, which has halted Ledger sales, and that its own systems and direct sales channels show no evidence of compromise. At the same time, security researchers and users have reported similar implants or suspicious modifications in Ledger devices bought from other channels, including European electronics retailer MediaMarktSaturn and a Singapore airport store, prompting MediaMarktSaturn to temporarily pull all Ledger products while it works with Ledger, as described in tampering reports involving European stores.

These newer reports have not yet been confirmed as fund-draining incidents, but photos show added cables and cellular modules consistent with the LTE spying design. Ledgers documentation and support posts note that its Genuine Check can verify the secure element chip but cannot detect physical add?on implants that leave that chip intact, a limitation highlighted in security coverage such as The Defiants summary of the spy implant issue.

3. Practical Security Steps For Users

For current Ledger owners, the main risk is not a remote software hack of genuine devices but physically tampered units or social?engineering scams that trick you into revealing your recovery phrase. Past data leaks of Ledger customer information have already fueled targeted phishing, including highly realistic physical letters and even counterfeit devices sent by mail, documented in community warnings about seed?stealing mail scams.

Safer patterns include buying hardware wallets directly from the manufacturer where possible, inspecting packaging and casings for signs of opening or modification, and treating any unsolicited device, email, or letter that asks for your 24 words as malicious by default. If you suspect your device may have been tampered with or sourced through a questionable reseller, a cautious user approach is to migrate funds to a new wallet initialized on a trusted device with a fresh recovery phrase, avoiding reuse of any potentially exposed seed.

Conclusion

Ledgers spy?chip incident shows that hardware wallets can be undermined through supply?chain tampering even when their cryptographic design and secure elements stay intact. For crypto users, the practical takeaway is that provenance, physical integrity and strict protection of the seed phrase matter as much as brand reputation, and that buying through trusted channels and refusing to share recovery phrases are critical defenses against these emerging hardware?level attacks.