TLDR
Ledger has confirmed a malicious hardware implant in some reseller sold hardware wallets that can capture and transmit users recovery seeds.
- Ledger found an unauthorized chip in devices sold by Southeast Asian distributor CryptoBilis that reads the 24 word seed from the screen and sends it over LTE.
- Investigators estimate around 70 to 90 million dollars stolen across Bitcoin, Ethereum, stablecoins, but Ledger has not yet verified the total losses or device count.
- Impact is tied to tampered reseller inventory, highlighting that hardware wallet supply chain security is critical and that users should scrutinize device provenance and move funds from suspect devices.
Deep Dive
1. How The Implant Steals Seeds
Ledgers security team confirmed that some devices sold via CryptoBilis contained an extra circuit board inside the case that taps the display output during setup.
Reports describe a microcontroller plus eSIM that recognizes the 24 word recovery phrase as it appears on the screen and then transmits it to attackers over LTE, with normal signing and the secure element left untouched, which makes the device appear legitimate to standard checks. This behavior is detailed in Ledgers description of a covert implant in CryptoBilis devices and in a follow up explaining components that captured users 24 word recovery phrases and transmitted them over LTE.
Ledger stresses this is a physical supply chain attack on some units, rather than a breach of its software, secure element, or core infrastructure.
2. Scale Of Losses And What Is Confirmed
On chain analysts and media reports currently estimate between about 72 million and 93 million dollars drained from hundreds of affected wallets across BTC, ETH and stablecoins, with one investigation citing up to 93 million stolen through compromised reseller devices.
Ledger has confirmed only a limited set of cases so far, all involving devices sold through CryptoBilis, and says it has no indication that products bought directly from Ledger or its internal systems were compromised, according to several TokenPost summaries of the incident. Tether reportedly froze more than 10 million USDT linked to theft addresses, but the exact victim count and final loss total remain unverified.
Meanwhile, at least one suspicious device bought from European retailer Mediamarkt was reported, prompting a temporary sales freeze on Ledger products, and other wallet makers such as OneKey are reacting by cutting ties with CryptoBilis and offering replacements.
3. What Users Should Do And Supply Chain Lessons
Ledger advises anyone who bought a device from CryptoBilis not to initialize it, and suggests that users who already generated a seed on such a device move assets to a fresh wallet created on a trusted device with a new recovery phrase, as summarized in multiple Ledger guidance notes.
More broadly, this incident shows that even reputable hardware wallet brands depend on secure distribution. Security now hinges not only on the device design, but also on verifiable sourcing, unopened packaging, and resistance to physical tampering before the box reaches you.
cold storage only protects you if the entire path from manufacturer to your hand is trustworthy, so provenance checks and cautious handling of any reseller sourced device are essential.
Conclusion
A seed stealing implant in reseller distributed hardware wallets turned a trusted security tool into an attack vector by quietly capturing recovery phrases at setup.
Until investigations conclude, the safest posture is to treat questionable hardware as untrusted, prioritize fresh seeds on verified devices, and watch how major wallet vendors strengthen their supply chain controls and anti tamper measures.
CoinsKid.Com