Attackers stole $102 million from Ledger wallets by tampering with devices before resale

A widespread tampering campaign targeting Ledger hardware wallets through Southeast Asian resellers has exposed a fundamental vulnerability in the supply chain of self-custody devices. Attackers intercepted recovery phrases during wallet setup by installing hidden electronics, stealing an estimated $102 million from hundreds of customers who believed their private keys were physically isolated from the internet.

• Attackers stole an estimated $102 million from 324 wallets across six networks by intercepting 24 recovery words during setup.
• Hidden electronics embedded inside genuine Ledger devices used an LTE connection to transmit recovery phrases displayed on screens.
• Ledger’s device verification tools cannot detect physical modifications inside the casing when the genuine security chip remains intact.

• $102M Estimated total stolen across 324 compromised wallets by Bitquery analysis.
• 324 Number of affected wallets identified in the attack spanning six blockchain networks.
• Oct. 10 Date Ledger confirmed an unauthorized implant in a customer’s hardware device.
• 24 Recovery words that must be kept secret and offline to protect wallet access.

In early October, customers in Southeast Asia discovered cryptocurrency missing from Ledger hardware wallets that remained fully functional. According to reporting by CryptoSlate, the devices had been purchased through CryptoBilis, an authorized reseller operating in Malaysia, Indonesia, and the Philippines. The customers believed their private keys were protected by tamper-resistant hardware, unaware that attackers had inserted a second piece of electronics inside the device casing before it reached their hands.

On October 10, Ledger confirmed that one customer’s device contained an unauthorized hardware implant.

Three days later, Ledger’s security team disclosed how the attack worked. The added electronics intercepted the wallet’s 24 recovery words as they appeared on the screen during initial setup and transmitted them over a mobile connection using an embedded SIM card. The device’s protected security chip, operating system, and transaction signatures remained unchanged and authentic. Blockchain analytics firm Bitquery estimates that attackers stole $102 million from 324 wallets across six networks, though Ledger has not confirmed this total or verified that every loss originated from an implanted device.

Recovery phrases exposed at the moment they first appear on screen

Hardware wallets do not store cryptocurrency directly. Coins remain on their respective blockchains, and the device’s sole function is to protect the private keys needed to authorize transactions, keeping those secrets isolated from malware on internet-connected computers and phones. When an owner approves a payment, the wallet signs the transaction cryptographically without exposing the keys to the computer.

This separation creates one critical vulnerability: the recovery phrase. During setup, Ledger devices display 24 words that can reconstruct the wallet and all its keys if the hardware is lost or damaged. Owners are instructed to write the phrase down, store it offline, and never share it. Anyone with access to those 24 words can restore the same accounts on another device, and a PIN protecting the original wallet will not prevent this. The CryptoBilis implant was engineered specifically for the brief window when these words appeared on the screen. A small controller intercepted the signal being sent to the display, reconstructed the complete recovery phrase, and transmitted it via LTE using an embedded SIM card inserted into the device. The attack required no breach of the protected chip, no deception of the owner, and no fake website. An owner could complete setup normally, use the wallet to approve legitimate transactions, and have no indication that someone else held an identical copy of the recovery words.

An optional additional passphrase can protect accounts created with it, but standard accounts are secured by the recovery words alone.

Device verification cannot detect components added inside the casing

Ledger’s Genuine Check feature verifies that a device contains an authentic Secure Element, the chip responsible for sensitive security operations. It can identify a counterfeit chip, but it cannot inspect every component inside the casing or prove that nothing has been added since manufacture. Ledger’s own security documentation warns that physical modifications may escape detection when the original chip remains intact, and this weakness was precisely what the implant exploited: the device could truthfully report on its Secure Element while concealing the extra circuitry beside it.

Tibane Labs examined modified Ledger Nano X devices fitted with electronics that monitored signals between the secure chip and the screen. More sophisticated specimens used a custom board hidden beneath the display and kept the device’s original battery, preventing detection through casual inspection. These specimens were separate from the CryptoBilis investigation and do not prove the same devices or attackers were involved, but they demonstrate why an authentic chip, correct signatures, and a normal-appearing wallet do not constitute proof that the entire device remains untampered.

Attackers intercepted genuine devices between manufacture and customer delivery

CryptoBilis was an authorized reseller operating across Malaysia, Indonesia, and the Philippines. Customers were not taking a reckless shortcut by buying through an authorized seller, as Ledger itself recommends this purchasing method. That makes this case more consequential than a counterfeit wallet bought from an anonymous seller: the question became whether a product could be trusted after passing through distributors, retailers, and anyone else with access to inventory.

In an October 15 update, Ledger said attackers bought genuine devices over several months, opened them, fitted custom components, and returned them to distribution through Southeast Asian resellers. The company described the incident as an attack on the distribution channel and stated that samples checked in warehouses and stores showed no tampering. Ledger asked authorized resellers and distributors in Southeast Asia and Hong Kong to suspend sales, tightened controls on returned products, and requested that sellers keep devices off display shelves. These measures acknowledge how critical physical access becomes when attackers can modify a product without altering the software inside it.

Germany’s MediaMarktSaturn suspended Ledger sales following a report of a tampered device, while rival wallet maker Trezor moved to reduce its reseller network despite finding no evidence that its own products were compromised.

Blockchain records cannot identify who tampered with devices before sale

Bitquery found that 25 Tron wallets signed the same approval within three seconds, a pattern consistent with someone already controlling multiple accounts. Blockchain records alone cannot identify who opened a package, installed a component, or returned a device to a shop. Investigating such a breach requires hardware examinations and distribution records that may never be fully disclosed.

For anyone who may have received a compromised wallet, the critical distinction lies between the device itself and the recovery phrase. A PIN protects the original device from unauthorized use, but it does nothing to prevent someone from restoring the same keys elsewhere. Buying a new hardware device and entering the old 24 words recreates the same risk. The only solution is to move assets to accounts generated from a fresh recovery phrase on a trusted device, using carefully verified addresses and instructions. Ledger has told customers who bought from CryptoBilis not to initialize unused devices and advised those who already set them up to transfer funds to a new signer with a new phrase, using only official support channels and preserving potentially relevant evidence.

The BlockWest read. Self-custody removes the need to trust an exchange with private keys, but not the need to trust the hardware that creates and displays them. The distribution chain, the supply warehouse, and the reseller shelf are now part of the security boundary. This incident signals that hardware wallet buyers must evaluate not only the device manufacturer’s engineering but also the integrity of every link between the factory and their hands.

Ledger has not disclosed whether it has identified additional tampered devices beyond those Bitquery flagged, whether it is working with law enforcement to trace the attackers, or whether it plans to redesign the wallet setup process to eliminate the moment when recovery words appear on an untrusted screen.

BlockWest is a news publication. Nothing here is investment advice. Read our disclaimer and editorial policy.