Ledger disclosed that a covert component embedded in some of its hardware wallets, distributed by the Southeast Asian reseller CryptoBilis, was used to exfiltrate users’ master seed phrases. The device-level implant operated independently of Ledger’s software stack, representing a classic physical supply-chain intrusion.
Mechanism of the Implant
The hidden module resided within the device’s enclosure and contained a tiny microcontroller equipped with an eSIM. When a user completed the wallet setup and the screen displayed the 24-word seed, the implant decoded the words in real time. It then leveraged LTE technology—identical to that used by mobile phones—to transmit the phrase to an external server. Crucially, the implant did not tamper with the secure element that safeguards private keys, nor did it alter transaction signatures, meaning the breach was limited to the recovery phrase itself.
Impact and Losses
On-chain analysts traced the fallout to more than 300 compromised wallets, estimating the total value stolen at roughly $93.2 million. The majority of the assets were moved to external addresses, and Tether subsequently froze $10 million of USDT linked to the incident. Ledger has confirmed at least one device containing the unauthorized hardware, and all reported losses in the October 9 event involved units sourced from CryptoBilis.
Ledger's Response
Ledger has urged anyone who purchased a Ledger signer from CryptoBilis not to initialise the device. Users who have already done so are instructed to generate a new recovery phrase on a clean device and transfer all holdings immediately. CryptoBilis has ceased sales of the affected hardware, and Ledger continues to investigate whether similar implants exist in other devices or locations.
Why it matters
The episode underscores the vulnerability of hardware wallets to supply-chain manipulation, even when the underlying firmware remains uncompromised. As custodial solutions rely heavily on the secrecy of recovery phrases, any breach of that data can bypass the cryptographic protections built into the device. The incident may prompt manufacturers to tighten physical security audits, and it serves as a reminder for users to source hardware only from verified channels.
