[REVISION HISTORY]

Ledger hardware wallet supply chain attack

Updated 10 times since CLSTR started tracking revisions of this situation.

What changed

2026-10-18 12:08 UTC → 2026-10-18 22:03 UTC · added ~~removed~~

Ledger is investigating a sophisticated supply chain attack involving unauthorized hardware implants in its cryptocurrency wallets. The implants, discovered in devices sold through the Southeast Asian reseller CryptoBilis, are designed to intercept 24-word recovery phrases displayed on the device screen and transmit them to attackers via an embedded eSIM using LTE cellular networks. Because these rogue components do not alter the device’s core security chip or firmware, the wallets continue to function normally and pass Ledger’s authenticity checks, allowing the theft to occur undetected. Forensic investigations reveal that criminals physically tampered with genuine devices before they reached consumers. Blockchain investigators and Chainalysis have updated damage estimates, with recent figures placing total losses between $90 million and $102 million. One specific incident involved a task-based scam operator who lost over 60 Bitcoin, valued at approximately $4.8 million to $4.9 million, across three Ledger wallets on October 9. Experts have also warned of secondary losses as panicked users inadvertently share recovery phrases with scammers while attempting to secure their assets. While Ledger has confirmed the presence of implants in devices from CryptoBilis, the company maintains that its own internal systems, infrastructure, and direct sales channels have not been compromised. The security incident has expanded beyond Southeast Asia, with reports of similar hardware modifications appearing in devices purchased through MediaMarktSaturn in Europe. In response, MediaMarktSaturn has suspended the sale of Ledger products, and Ledger has requested that distributors in several Southeast Asian nations halt sales pending further investigation. ~~Recent developments have sparked debate regarding corporate transparency.~~ Former Mt. Gox CEO Mark Karpelès has criticized ~~Ledger, claiming~~ Ledger’s response, alleging the company ~~could have prevented much~~ received reports of these implants as early as December 2025 but did not issue a public post until March 2026. Karpelès accused Ledger of downplaying the ~~loss if~~ incident by framing it ~~had issued stronger~~ as isolated to a specific reseller. In response to the crisis, Karpelès announced a project to develop an inexpensive device to detect unauthorized antenna components using low-power radio signal and resonance testing, intending to make the technical specifications public ~~warnings after receiving reports of tampered devices earlier in 2026.~~ so users can build their own detectors.

Versions

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.