Ledger has revealed how attackers stole tens of millions of dollars in cryptocurrency from its hardware wallets: a covert cellular implant hidden inside devices sold by Southeast Asian reseller CryptoBilis read users' 24-word recovery phrases from the screen and transmitted them over a mobile phone network.
In an investigation update posted on X on Tuesday, Ledger's Donjon security team said the implant sat inside the wallet's casing. During setup, when the device displayed the recovery phrase, the implant's microcontroller recognized and decoded the words, then sent them over LTE using an embedded SIM (eSIM).
The recovery phrase is the master key to a crypto wallet. Anyone who holds it can recreate the wallet elsewhere and move the funds without ever touching the physical device. Onchain researchers estimate more than 300 wallets were drained, with losses of up to $93.2 million.
A physical attack, not a software breach
Ledger stressed that the incident was a physical supply-chain attack, not a breach of its software or internal systems. The implant did not modify the device's Secure Element — the chip built to protect private keys — nor its operating system, transactions or signatures.
The update is the first public explanation of the mechanism behind the thefts. Ledger initially confirmed an unauthorized component on October 10 but had not publicly established how it worked at that stage.
"We have not verified a drain linked to a signer bought elsewhere," Ledger said, though researchers are reviewing reports of hardware modifications in other devices and locations.
Fallout spreads across the region
The discovery has triggered escalating fallout. CryptoBilis has suspended sales and shipments of all hardware wallet brands in Malaysia, the Philippines and Indonesia, closed its physical stores, and said it is reviewing its processes with independent specialists.
Rival wallet makers are distancing themselves. Trezor said it had received no reports of tampered devices sold through CryptoBilis but removed the company from its authorized reseller network anyway. OneKey similarly ended CryptoBilis' authorization, paused onboarding of new resellers and began reviewing its distribution network.
In a separate report, an X user posted photos of two Ledger devices bought from separate stores of MediaMarkt, a European consumer electronics chain, claiming to have found implants in both. Ledger has not confirmed whether the European reports are linked to the CryptoBilis incident.
What Ledger is doing next
"Ledger is reviewing its reseller controls and anti-tamper protections," CTO Charles Guillemet said on X. "We invite researchers and other vendors to work with us on tamper-detection and chain-of-custody practices."
CEO Pascal Gauthier said the company is reviewing controls for direct sales and resellers and will share what it can, adding that the investigation is ongoing.
The episode is a reminder that hardware wallets keep private keys offline — but the physical device itself, and the supply chain that delivers it, is now part of the attack surface.
By Hamza Faisal
