CryptoSlate
Ledger confirmed an unauthorized hardware implant in a genuine wallet after customers in Southeast Asia reported missing crypto. The added electronics captured 24-word recovery phrases during setup and transmitted them over LTE through an embedded SIM. Bitquery estimates that attackers stole $102 million from 324 wallets across six networks, although Ledger has not confirmed that total or linked every loss to an implanted device.
Why it matters
Hardware wallets keep private keys isolated from internet-connected devices, but setup creates a critical exposure point. The recovery phrase can recreate the wallet and its keys on another device, so a PIN cannot protect funds once someone else has copied the words.
The implant reportedly intercepted information sent from the secure chip to the display, reconstructed the phrase, and transmitted it without breaking the protected chip or altering transaction signatures. Owners could complete setup and use the wallet normally while an attacker retained an identical path to the funds.
Ledger's Genuine Check verifies the presence of an authentic Secure Element, but it cannot inspect every component inside the casing. That blind spot allowed a modified device to appear genuine while containing extra circuitry. The case involved CryptoBilis, an authorized reseller in Malaysia, Indonesia, and the Philippines, making the distribution channel rather than an anonymous counterfeit market the central risk.
Market impact
Ledger advised CryptoBilis customers not to initialize unused devices and told those who had already set them up to move funds to a fresh signer with a new recovery phrase. Replacing the hardware while reusing the old 24 words would preserve the compromise.
The incident raises the operational burden of self-custody. Trust now extends beyond the secure chip to the casing, display, packaging, returns process, retailers, and distributors. Ledger suspended sales through affected Southeast Asian channels, while MediaMarktSaturn paused Ledger sales in Germany and Trezor moved to reduce its reseller network despite finding no evidence that its products were compromised.
Frequently asked questions
-
How did the Ledger implant steal recovery phrases?
The implant intercepted information sent from the secure chip to the display, reconstructed the 24-word phrase during setup, and transmitted it over LTE through an embedded SIM.
-
How much crypto was reportedly stolen in the Ledger case?
Bitquery estimates that attackers stole $102 million from 324 wallets across six networks. Ledger has not confirmed that total or linked every loss to an implanted device.
-
Why did Ledger's Genuine Check not detect the modified wallets?
Genuine Check verifies that a device contains an authentic Secure Element, but it does not inspect every component inside the casing or prove that nothing was added.
-
Does changing the Ledger device protect an exposed recovery phrase?
No. Reusing the old 24 words on a new device recreates the same wallet and preserves the compromise. Affected users were advised to move funds to accounts created with a fresh phrase.
-
What part of the supply chain was involved in the incident?
The case involved CryptoBilis, an authorized reseller operating in Malaysia, Indonesia, and the Philippines. Ledger said genuine devices were opened, modified, and returned to distribution.
WuBlockchain
CoinDesk
WatcherGuru
Crypto Rank News