Hidden Hardware Implant in Crypto Wallets Stole Recovery Phrases, Ledger Says

Cryptocurrency hardware wallets sold through a Southeast Asian reseller contained hidden hardware implants that captured users’ recovery phrases and transmitted them to attackers, according to wallet manufacturer Ledger.

In a report published on October 13, Ledger said its security team identified tampered devices sold through reseller CryptoBilis. The implants reportedly detected the 24-word recovery phrase displayed during wallet setup and transmitted it over a cellular connection using an embedded eSIM.

Attackers subsequently used the stolen phrases to access victims’ cryptocurrency funds. The thefts were reported on October 9, although Ledger has not confirmed the total financial losses or the number of affected devices.

The incident raises concerns about hardware supply-chain security. According to Ledger, the implants left the devices’ Secure Element intact, meaning tampered products could potentially pass certain authenticity checks.

CryptoBilis has paused sales and shipments of Ledger devices while the investigation continues. Ledger advises customers who purchased devices through the reseller not to activate unused wallets and to contact its support team. Users who have already configured affected devices are advised to move their assets to a new wallet with a newly generated recovery phrase.

For digital investigators, the case highlights the importance of examining hardware integrity, tracing cryptocurrency transactions and preserving devices for forensic analysis. The source and extent of the compromise remain under investigation.

The investigation is ongoing; the full scope of the incident has not been confirmed.