[CLSTR]
< Back to situations

Monitor this situation.

[SITUATION] · [ACTIVE] · [TECHNOLOGY]

6 clusters · 103 sources · 13 days · First seen · Last updated

Ledger hardware wallet supply chain attack

Overview

Ledger is investigating a sophisticated supply chain attack involving unauthorized hardware implants in its cryptocurrency wallets. The implants, discovered in devices sold through the Southeast Asian reseller CryptoBilis, are designed to intercept 24-word recovery phrases displayed on the device screen and transmit them to attackers via an embedded eSIM using LTE cellular networks. Because these rogue components do not alter the device’s core security chip or firmware, the wallets continue to function normally and pass Ledger’s authenticity checks, allowing the theft to occur undetected.

Forensic investigations reveal that criminals physically tampered with genuine devices before they reached consumers. Blockchain investigators and Chainalysis have updated damage estimates, with recent figures placing total losses between $90 million and $102 million. The security incident has expanded beyond Southeast Asia, with reports of similar hardware modifications appearing in devices purchased through MediaMarktSaturn in Europe. In response, MediaMarktSaturn has suspended the sale of Ledger products, and Ledger has requested that distributors in several Southeast Asian nations halt sales pending further investigation.

Former Mt. Gox CEO Mark Karpelès has criticized Ledger’s response, alleging the company received reports of these implants as early as December 2025 but did not issue a public post until March 2026. Karpelès accused Ledger of downplaying the incident by framing it as isolated to a specific reseller. In response to the crisis, Karpelès announced a project to develop an inexpensive device to detect unauthorized antenna components using low-power radio signal and resonance testing, intending to make the technical specifications public so users can build their own detectors.

Entities

CryptoBilis · Ledger · Southeast Asia · Mark Karpelès · Trezor

Claims

What the coverage asserts, and how many sources carry each claim.

Coverage disagrees

Sources make claims that cannot both be true. CLSTR reports the disagreement; it does not decide who is right.

Timeline

  1. [TECHNOLOGY] 2 sources
    Ledger hardware wallets compromised via physical supply chain tampering

    Unauthorized components in some Ledger hardware wallets, distributed via CryptoBilis, were found to intercept recovery phrases via LTE, leading to significant reported asset thefts.

  2. [TECHNOLOGY] 10 sources
    Ledger hardware wallets compromised by supply chain implants

    Criminals have reportedly drained over $90 million in cryptocurrency by implanting malicious hardware into Ledger wallets via supply chain attacks, bypassing traditional security measures.

  3. [TECHNOLOGY] 13 sources
    Ledger hardware wallets targeted in $102 million supply-chain attack

    Criminals stole an estimated $102 million by embedding hardware implants in tampered Ledger wallets sold via CryptoBilis. The implants intercepted 24-word recovery phrases via LTE connections.

  4. [TECHNOLOGY] 35 sources
    Ledger investigates hardware wallet supply chain attack

    Ledger is investigating a supply chain attack where hardware implants in wallets stole recovery phrases. Sales are suspended in Southeast Asia and Europe, with estimated losses reaching up to $93 million.

  5. [TECHNOLOGY] 22 sources
    Ledger confirms hardware implants in wallets following massive crypto theft

    Ledger confirmed hardware implants in wallets sold via CryptoBilis were used to steal recovery phrases. Losses are estimated over $86 million, prompting retail suspensions and reseller network cuts by Trezor.

  6. [TECHNOLOGY] 68 sources
    Ledger investigates hardware implants in devices sold via CryptoBilis

    Ledger is investigating a supply chain attack where malicious hardware implants in devices sold by CryptoBilis reportedly enabled the theft of over $93 million in cryptocurrency assets.

Sources

ad-hoc-news.de · agcensus.usda.gov · altcoininvestor.com · ambcrypto.com · bitcoinbasis.de · bitcoinke.io · bitcoinsistemi.com · bitcoinworld.co.in · bittimes.net · block-builders.de · blockcast.it · blockchainreporter.net · blockmedia.co.kr · blockonomi.com · blocktempo.com · blockzeit.com · blogs.airdropalert.com · blogtienao.com · btc-echo.de · btcnews.jp · btcwires.com · business-punk.com · coin-turk.com · coinacademy.fr · coincu.com · coindeskjapan.com · coindoo.com · coinpaper.com · coinpost.jp · cointelegraph.com · cointribune.com · comparic.pl · criptoinforme.com · criptotendencias.com · crypto-insiders.nl · crypto-times.jp · crypto.news · cryptoast.fr · cryptobreaking.com · cryptobriefing.com · cryptonews.com.au · cryptopolitan.com · cryptoslate.com · cryptoweek.fr · cyberinsider.com · cybernoz.com · dday.it · decrypt.co

This summary has been updated 10 times: see revision history