# Ledger hardware wallet supply chain attack > Live situation record from CLSTR: https://clstr.news/situations/20261012-ledger-hardware-wallet-supply-chain-attack > Updated: 2026-10-22T11:29:38.000Z. Sources: 103. Developments: 6. Ledger is investigating a sophisticated supply chain attack involving unauthorized hardware implants in its cryptocurrency wallets. The implants, discovered in devices sold through the Southeast Asian reseller CryptoBilis, are designed to intercept 24-word recovery phrases displayed on the device screen and transmit them to attackers via an embedded eSIM using LTE cellular networks. Because these rogue components do not alter the device’s core security chip or firmware, the wallets continue to function normally and pass Ledger’s authenticity checks, allowing the theft to occur undetected. Forensic investigations reveal that criminals physically tampered with genuine devices before they reached consumers. Blockchain investigators and Chainalysis have updated damage estimates, with recent figures placing total losses between $90 million and $102 million. The security incident has expanded beyond Southeast Asia, with reports of similar hardware modifications appearing in devices purchased through MediaMarktSaturn in Europe. In response, MediaMarktSaturn has suspended the sale of Ledger products, and Ledger has requested that distributors in several Southeast Asian nations halt sales pending further investigation. Former Mt. Gox CEO Mark Karpelès has criticized Ledger’s response, alleging the company received reports of these implants as early as December 2025 but did not issue a public post until March 2026. Karpelès accused Ledger of downplaying the incident by framing it as isolated to a specific reseller. In response to the crisis, Karpelès announced a project to develop an inexpensive device to detect unauthorized antenna components using low-power radio signal and resonance testing, intending to make the technical specifications public so users can build their own detectors. ## Claims - MediaMarktSaturn has suspended the sale of Ledger devices in its physical stores and online shops across Europe. (disputed by 7 sources) - Confirmed incidents of hardware tampering are currently limited to Southeast Asia. (disputed by 5 sources) - Ledger confirmed that at least one affected hardware wallet contained an unauthorized hardware implant. (corroborated by 10 sources) - Ledger has requested distributors in Indonesia, Singapore, Thailand, Philippines, Vietnam, Malaysia, and Hong Kong to suspend sales. (corroborated by 10 sources) - The hardware implant intercepts the 24-word recovery phrase displayed on the screen and transmits it via an embedded eSIM using LTE. (corroborated by 8 sources) - Reseller CryptoBilis has suspended hardware wallet sales pending an investigation. (corroborated by 7 sources) - Blockchain investigator Specter estimated potential losses could exceed $86 million across Bitcoin, Ether, and TRON. (corroborated by 6 sources) - Ledger stated its own infrastructure, systems, and services were not compromised. (corroborated by 6 sources) - No loss of funds has been reported in relation to the reported tampering in Germany. (corroborated by 6 sources) ## Timeline ### 2026-10-22: Ledger hardware wallets compromised via physical supply chain tampering Unauthorized components in some Ledger hardware wallets, distributed via CryptoBilis, were found to intercept recovery phrases via LTE, leading to significant reported asset thefts. 2 sources. https://clstr.news/cluster/ledger-hardware-wallets-compromised-via-physical-supply-chain-tampering ### 2026-10-18: Ledger hardware wallets compromised by supply chain implants Criminals have reportedly drained over $90 million in cryptocurrency by implanting malicious hardware into Ledger wallets via supply chain attacks, bypassing traditional security measures. 10 sources. https://clstr.news/cluster/mark-karpels-criticizes-ledger-over-hardware-implant-security-response ### 2026-10-16: Ledger hardware wallets targeted in $102 million supply-chain attack Criminals stole an estimated $102 million by embedding hardware implants in tampered Ledger wallets sold via CryptoBilis. The implants intercepted 24-word recovery phrases via LTE connections. 13 sources. https://clstr.news/cluster/ledger-hardware-wallets-compromised-in-90-million-supply-chain-attack-1 ### 2026-10-14: Ledger investigates hardware wallet supply chain attack Ledger is investigating a supply chain attack where hardware implants in wallets stole recovery phrases. Sales are suspended in Southeast Asia and Europe, with estimated losses reaching up to $93 million. 35 sources. https://clstr.news/cluster/ledger-investigates-tampered-hardware-wallets-in-germany ### 2026-10-12: Ledger confirms hardware implants in wallets following massive crypto theft Ledger confirmed hardware implants in wallets sold via CryptoBilis were used to steal recovery phrases. Losses are estimated over $86 million, prompting retail suspensions and reseller network cuts by Trezor. 22 sources. https://clstr.news/cluster/ledger-confirms-hardware-wallet-implant-in-supply-chain-attack ### 2026-10-09: Ledger investigates hardware implants in devices sold via CryptoBilis Ledger is investigating a supply chain attack where malicious hardware implants in devices sold by CryptoBilis reportedly enabled the theft of over $93 million in cryptocurrency assets. 68 sources. https://clstr.news/cluster/ledger-suspends-cryptobilis-sales-following-86m-crypto-theft-reports --- Cite as: Ledger hardware wallet supply chain attack. CLSTR, https://clstr.news/situations/20261012-ledger-hardware-wallet-supply-chain-attack