Hardware wallets exist for one reason: your keys never leave the device. This week, for some Ledger owners, that promise broke before the box was even opened.
What happened
Somewhere between the factory and the customer, someone opened a batch of Ledger devices and hid a small chip inside the casing. The chip waited for setup. When the screen showed the 24-word recovery phrase, the chip read it, decoded it and sent it to the attacker over a mobile network, using its own eSIM.
The owner noticed nothing. The device worked normally, and transactions signed fine. Meanwhile the attacker already held the master key and could rebuild the wallet anywhere and empty it.
Ledger says its own security chip and software were never touched. This was a physical attack on the supply chain, not a hack of Ledger itself. For anyone who lost funds, that distinction doesn’t change much.
How big is it
Every confirmed loss so far traces back to devices sold by CryptoBilis, a reseller in Southeast Asia. The damage now stands at up to $102 million across more than 300 wallets.
It may not stop there. Ledger says MediaMarkt Saturn stopped selling its devices after a customer in Germany reported an implant. Mark Karpelès, the former head of Mt. Gox, says he found one in a Ledger Flex bought at Singapore Airport.
Trezor has also responded:
What you should do
If you bought from CryptoBilis and haven’t set the device up yet: don’t initialize it.
If you’re already using one: move your funds to a new device with a newly generated recovery phrase. Do it today, not this weekend.
If you don’t know where your device came from: treat it as compromised. If you bought it second-hand, through a reseller or at an airport shop, generate a fresh wallet on a device bought directly from the manufacturer.
For any future purchase: buy only from the manufacturer. Saving a few dollars at a reseller isn’t worth it.
Watch your inbox
Scammers will use this news. Expect “Ledger support” DMs, urgent “security check” emails and helpful “migration tools.” All of them are scams.
Ledger won’t contact you, and neither will SWAPD staff. Nobody legit will ever ask for your recovery phrase.
Stay sharp.
Sources
- Ledger: Ledger on X: "Update from Ledger Donjon on the CryptoBilis investigation 🔽 @DonjonLedger is investigating Ledger signers sold by CryptoBilis, a reseller in Southeast Asia, that contained an unauthorized hardware implant. Ledger confirmed this on October 10th for one affected user's signer. All co… / X
- Mark Karpelès: Mark Karpelès on X: "Ledger Flex sold at Singapore Airport confirmed to contain a spy implant! @BenYorke found suspicious marks on his @Ledger and sent it to me rather than using it, that was probably the best decision here. https://t.co/aP7gDEbvtq https://t.co/3VumJyBFD2" / X
- Trezor: Trezor on X: "Following recent supply-chain incidents, we decided to reduce the number of resellers so we can more effectively check those we work with. Let us be very clear: there is not a single piece of evidence that Trezor devices have been compromised. This is a preventive step, taken out… / X
