Ledger wallets sold with spy chips that stole seed phrases

Ledger says a criminal group bought genuine Ledger hardware wallets, hid a spy chip inside each one, and fed them back into stores through resellers in Southeast Asia. The chip read each buyer's recovery phrase as it appeared on screen and sent it out over a mobile network. Thieves then emptied the wallets. Onchain researchers estimate losses of up to $93.2 million across more than 300 wallets, TheStreet reports, though Ledger has not confirmed a total.

A hardware wallet is a small device that stores the keys to cryptocurrency offline. Its whole promise is that the secret never touches an internet-connected computer. This attack did not break that design. It went around it.

How the implant worked

All confirmed thefts trace to devices sold by CryptoBilis, a Malaysia-based reseller, BleepingComputer reports. Researchers say those devices were offered at nearly half the normal price.

Mark Karpelès and Tibane Labs took apart affected units and described what they found, BleepingComputer says:

• A hidden board behind the screen. It captured what the display showed and which buttons were pressed.
• A smaller replacement battery to power the extra chip.
• A built-in eSIM, a digital SIM card, so the chip could send data over an LTE mobile network.

The target was the recovery phrase, or seed phrase. That is the list of 24 words a wallet shows once during setup, and anyone who has it controls the funds. The chip did not touch Ledger's secure element, the locked chip that holds the keys, and it did not change any transactions, Ledger told TheStreet.

That is why Ledger's own checks missed it. Its Genuine Check is a test that confirms a device is authentic. Ledger's support pages warn that it does not detect added parts if the original secure element is intact, BleepingComputer reports.

What Ledger says happened

Ledger opened an investigation on October 9 after users reported drained wallets and confirmed the tampering a day later. On October 15 it published its fullest account in a blog post. The company says the group bought real devices over many months, modified them and returned them to the supply chain.

"This was an attack on the distribution channel after the devices left our control," Ledger wrote. It says its chips, operating system and servers were not compromised.

Ledger's chief executive, Pascal Gauthier, told TheStreet that "physical supply chain tampering is a risk for the whole industry."

Reports on the size of the losses differ:

Estimate	Source
Up to $93.2 million, more than 300 wallets	CoinDesk onchain estimates, via TheStreet
Above $90 million	Galaxy Digital, via TheStreet
Unknown	Ledger and Privacy Guides

Tether, which issues the USDT stablecoin, froze $10 million in USDT, TheStreet reports.

A dispute over German stores

TheStreet reports that tampered devices also turned up at German retailer MediaMarkt, which removed Ledger products from its stores and website. Ledger's own blog post says it bought devices from German stores and checked warehouse samples. "Every unit examined was clean," it says. The two accounts have not been reconciled.

What this means for developers

The lesson reaches beyond crypto. Any security device, from a hardware key to a phone, is only as trustworthy as the path it took to your desk.

For Ledger owners, the advice is direct. "If you bought a Ledger signer from CryptoBilis and have not set it up, do not set it up," Ledger's chief technology officer, Charles Guillemet, told TheStreet. If you already set one up, move your funds to a new device with a new recovery phrase, Ledger says, according to Privacy Guides.

For teams that buy security hardware:

• Buy from the maker or an authorized seller. A price far below retail is a warning sign, not a deal.
• Do not trust a software check to find extra hardware. Ledger's Genuine Check passed these devices.
• Never show a long-lived secret on a device you have not inspected.

Ledger has asked resellers to stop sales in Southeast Asia and Hong Kong. It is adding rules for its sellers: no products on open shelves or displays, stock kept in the back until purchase, and fast reporting of anything unusual. It says it is working with police and will publish more technical details.