Tampered Ledger wallets: $86M+ stolen after reseller supply-chain implant
Ledger says wallets sold through the reseller CryptoBilis appear to be behind losses of an estimated $86–93 million, and that at least one device held an unauthorized hardware implant. It is a reminder that a hardware wallet is only as trustworthy as the route it took to the buyer.
Key Takeaways
- More than 300 Ledger wallets suffered estimated losses of $86–93 million across Bitcoin, Ethereum and Tron.
- Ledger says the affected wallets appear to have been sold via the reseller CryptoBilis, and that at least one device contained an unauthorized hardware implant.
- Third-party researchers who disassembled affected devices reported an added chip and antenna designed to send seed phrases to the attacker over a cellular connection.
- The failure sits in the distribution channel, not in the cryptography. Buying through unofficial resellers moves the trust boundary to someone you cannot audit.
What was reported
Users of more than 300 Ledger hardware wallets have lost an estimated $86 million to $93 million, with assets drained across blockchains including Bitcoin, Ethereum and Tron, according to Web3 Is Going Great. Ledger has said the targeted wallets appear to have been sold through CryptoBilis, a reseller operating in Indonesia, Malaysia and the Philippines. It has also said at least one affected device "contained an unauthorized hardware implant".
Per the same summary, third-party researchers disassembled affected devices and found an added chip and antenna. The implant was designed to capture wallet seed phrases and transmit them to the attacker over a cellular connection.
What is not yet public
The reporting does not name the researchers, give a timeline of the thefts, or say how many devices carried implants. We also do not know where in the chain the tampering happened: at the reseller, or before it. Treat any stronger claim about the root cause as unverified until Ledger or the reseller publishes more detail.
Why this matters beyond crypto
A hardware wallet exists to keep key material away from internet-connected machines. A physical implant that exfiltrates the seed phrase over its own radio sidesteps that design goal, because the secret leaves the device through a channel the user never sees. The usual software defences, such as malware scanning and host hardening, do not help when the device itself is hostile.
This is a hardware supply-chain compromise, the physical counterpart of a poisoned npm or PyPI package. In both cases the product is legitimate at the source, and trust is lost at an intermediary the buyer did not vet.
Practical takeaways
- Buy from the manufacturer or an authorised channel. Procurement is a security control, and unofficial resellers extend your trust boundary.
- Treat a pre-owned or unusually cheap device as untrusted. Any seed phrase that has touched a device of uncertain provenance should be considered exposed.
- Add receiving-side checks to procurement for organisations holding digital assets. These include tamper-evident packaging inspection and a documented chain of custody for devices.
- Plan for hardware compromise in incident response. If tampering is suspected, move funds to a freshly generated wallet from a verified device rather than trying to clean the old one.
Frequently Asked Questions
What did researchers find inside the tampered Ledger devices?
According to the reporting, third-party researchers who disassembled affected devices found an added chip and antenna, designed to capture seed phrases and send them to the attacker over a cellular connection.
How much was stolen and on which blockchains?
Estimated losses are $86 million to $93 million across more than 300 wallets, with assets drained on blockchains including Bitcoin, Ethereum and Tron.
How can buyers reduce the risk of tampered hardware wallets?
Purchase directly from the manufacturer or an authorised channel, inspect packaging, and treat any device of uncertain provenance as untrusted. If tampering is suspected, move funds to a new wallet set up on a verified device.