Tampered Ledger Wallets Stole Recovery Phrases Before Setup

Attackers inserted hidden electronics into genuine Ledger hardware wallets sold through CryptoBilis, an authorized reseller in Malaysia, Indonesia and the Philippines. The devices captured customers’ 24-word recovery phrases during setup and sent them to the attackers, who then accessed affected accounts.

Ledger confirmed an unauthorized implant in one device on Oct. 10, after customers reported missing cryptocurrency from wallets that appeared to work normally. On Oct. 13, the company explained that the added electronics read the recovery words as they appeared on the wallet’s screen and transmitted them over a mobile connection.

In an Oct. 15 update, Ledger reported that attackers had bought genuine wallets over several months, opened them, installed custom components and returned them to distribution in Southeast Asia. The company described the incident as an attack on its distribution channel.

The implant did not need to break Ledger’s Secure Element, the chip used for sensitive security operations, or alter the wallet’s operating system. A small controller intercepted information sent to the display, reconstructed the recovery phrase and transmitted it over LTE through an embedded SIM card.

A recovery phrase can recreate a wallet and its private keys on another device. Anyone who obtains the phrase can access the associated accounts without knowing the original wallet’s PIN. The owner may continue using the device and approving legitimate transactions without receiving a warning.

Blockchain analytics firm Bitquery estimates that attackers took $102 million from 324 wallets across six networks. Ledger has not confirmed that figure or established that every reported loss came from an implanted device. Bitquery also found 25 Tron wallets that approved the same transaction within three seconds, a pattern consistent with control of multiple accounts.

Ledger’s Genuine Check verifies that a wallet contains an authentic Secure Element. It does not inspect every component inside the casing or prove that the device has not been physically modified while the original chip remains intact.

Security researchers at Tibane Labs separately examined modified Ledger Nano X devices containing electronics that monitored signals between the Secure Element and the screen. One specimen used a custom board beneath the display and retained the original battery. The research did not establish a connection between those devices and the CryptoBilis case.

Ledger reported that checks of samples in warehouses and stores had found no tampering. The company asked authorized resellers and distributors in Southeast Asia and Hong Kong to suspend sales, tightened controls on returned products and instructed sellers to keep devices off display shelves.

MediaMarktSaturn suspended Ledger sales in Germany after a report of a tampered device. Trezor, a competing hardware-wallet maker, began reducing its reseller network despite finding no evidence that its products had been compromised.

Ledger advised CryptoBilis customers not to initialize unused devices. Customers who had already set up the wallets were told to transfer their assets to accounts created with a new recovery phrase on a trusted device. Buying another device and entering the old 24 words would recreate the same exposure.

Hardware wallets keep private keys separate from internet-connected phones and computers and use those keys to sign transactions. During setup, however, the recovery words appear on the device’s screen. The CryptoBilis implant targeted that process before customers made their first transaction.