started · updated
Ledger confirms hardware implants in wallets following massive crypto theft
Cryptocurrency hardware wallet manufacturer Ledger has confirmed that unauthorized hardware implants were discovered in devices, enabling attackers to steal recovery phrases. The implants, which include an embedded eSIM and LTE capability, intercept the 24-word recovery phrase displayed on the screen during setup and transmit it to attackers.
While Ledger stated its internal infrastructure and direct sales channels remain secure, the company confirmed that all verified thefts are linked to devices sold through the Southeast Asian reseller CryptoBilis. Blockchain investigators have estimated potential losses exceeding $86 million across Bitcoin, Ether, and TRON, though Ledger has not officially confirmed the total amount stolen.
Reports of tampered devices have since emerged in Europe, with users claiming to have found similar modifications in wallets purchased from MediaMarkt. In response, MediaMarkt has suspended sales of Ledger products. Additionally, rival wallet manufacturer Trezor announced it will significantly reduce its authorized reseller network starting January 1, 2027, as a precautionary measure to enhance supply chain oversight.
Entities
Bitcoin · CryptoBilis · Ether · Ledger · MediaMarkt · Specter · Tether · Trezor
Claims
What the coverage asserts, and how many sources carry each claim.
- [○ 1 SOURCE] The incident appears to be isolated to a specific reseller and its market. bitcoinke.io
- [● 10 SOURCES] The compromised devices were sold through the Southeast Asian reseller CryptoBilis. bitcoinke.io · www.it-boltwise.de · phocapblockchain.net · timesng.com · www.nadanews.com · +2 more
- [● 10 SOURCES] Ledger confirmed that at least one affected hardware wallet contained an unauthorized hardware implant. bitcoinke.io · www.it-boltwise.de · phocapblockchain.net · timesng.com · www.nadanews.com · +3 more
- [● 6 SOURCES] Ledger stated its own infrastructure, systems, and services were not compromised. bitcoinke.io · phocapblockchain.net · timesng.com · crypto.news · therecord.media
- [● 7 SOURCES] Reseller CryptoBilis has suspended hardware wallet sales pending an investigation. bitcoinke.io · phocapblockchain.net · timesng.com · www.nadanews.com · therecord.media
- [● 6 SOURCES] Blockchain investigator Specter estimated potential losses could exceed $86 million across Bitcoin, Ether, and TRON. bitcoinke.io · phocapblockchain.net · timesng.com · www.it-boltwise.de
- [● 8 SOURCES] The hardware implant intercepts the 24-word recovery phrase displayed on the screen and transmits it via an embedded eSIM using LTE. timesng.com · www.nadanews.com · cryptoast.fr · www.gizmodo.jp · therecord.media · +3 more
- [○ 1 SOURCE] Blockchain investigators have traced suspected crypto theft exceeding $100 million across hundreds of wallets. www.tokenpost.com
- [● 3 SOURCES] Trezor will reduce its authorized reseller network starting January 1, 2027, as a precautionary measure. www.btc-echo.de · decrypt.co
- [● 4 SOURCES] MediaMarkt has suspended the sale of Ledger products in its stores and online following reports of device implants in Europe. www.crypto-insiders.nl · crypto.news · cyberinsider.com · www.btc-echo.de
- [● 3 SOURCES] MediaMarkt has suspended the sale of Ledger products in its physical and online stores. www.crypto-insiders.nl · crypto.news · cyberinsider.com
- [● 3 SOURCES] Trezor will reduce its authorized reseller network effective January 1, 2027. www.btc-echo.de · decrypt.co