Ledger Hardware Wallets Compromised by Cellular Implants in Supply-Chain Attack

Ledger has confirmed that hardware wallets sold through Southeast Asian reseller CryptoBilis contained malicious implants designed to steal recovery phrases.

The implants used a tiny microcontroller to read the 24-word seed displayed during device setup and transmitted the data over cellular networks via an embedded SIM. Ledger's security team found the attack did not touch the secure element or alter transaction signing — it only exfiltrated the seed phrase.

How the supply-chain attack worked

Attackers intercepted devices in transit and soldered a secondary circuit board inside the casing. This board housed an LTE modem and a chip that captured screen output when the recovery phrase appeared. The stolen seeds were then sent silently over mobile networks to the attackers, giving them full control of the victim's funds. Losses are estimated to exceed $86 million across Bitcoin, Ethereum, and Tron.

What this means for self-custody

The breach is a reminder that hardware wallet security depends on the entire supply chain, not just the device's architecture. Buying from unauthorized or even authorized-but-compromised resellers introduces risk no firmware update can fix. Ledger says its core infrastructure was not breached and the issue is isolated to CryptoBilis-sold units in Indonesia, Malaysia, and the Philippines.

Users who purchased from this reseller should assume their seed is compromised and migrate funds to a fresh wallet generated on a clean device. Verify the tamper-evident seal, buy direct or from major distributors, and never share a seed phrase displayed on screen — even with the device itself.