Ledger hardware implants drain over $90 million from crypto wallets

Cellular chips hidden behind screens in devices sold by authorized retailers transmitted recovery phrases across mobile networks.

Coordinated thefts across hundreds of cryptocurrency accounts have exposed physical implants concealed inside hardware wallets sold by authorized retailers.¹² The compromised devices, manufactured by Paris-based hardware wallet maker Ledger, contained covert add-on circuits designed to intercept secret recovery phrases directly from the device displays during initial setup.²³ The stolen credentials allowed unauthorized attackers to reconstruct the wallets remotely and siphon digital assets valued by external researchers between $72 million and $102 million on October 9, 2026.¹⁴³

The incident represents a rare real-world compromise of offline cryptocurrency storage through physical distribution networks. Hardware signers are designed specifically to isolate cryptographic keys from internet-connected computers and smartphones. By attaching an independent data-logging component directly behind the screen, the attackers bypassed the device's cryptographic protections without modifying the underlying firmware or cracking the internal security chip.

Interception at the Display Buffer

The mechanism behind the compromise relied on physical proximity to the screen rather than a digital exploit of the wallet's operating system. During the initial setup of a Ledger device, the unit generates a random 24-word recovery phrase, which serves as the master key to all associated cryptographic accounts.²¹ The device displays each word sequentially on its compact display so the user can record it on paper.¹⁵

The unauthorized hardware implant sat quietly inside the device casing.²¹ As the wallet pushed each character of the phrase to the screen, the implant's microcontroller copied and recorded the text.¹² The component then utilized a covert antenna, an LTE cellular module, and an embedded subscriber identity module, or eSIM, to broadcast the stolen phrase over commercial cellular networks to remote command-and-control servers.²¹ Once in possession of the recovery phrase, an attacker could recreate the private keys on any compatible software or hardware wallet and transfer balances without physical access to the original unit.⁵²

Ledger confirmed that the implant left the device's certified Secure Element chip intact.²³ Because the Secure Element remained genuine and unmodified, the compromised units continued to pass the company's automated authenticity checks when plugged into computers, giving buyers no digital warning of tampering.⁵³

From Hand-Soldered Wires to Mass Production

The implants uncovered in recent weeks represent the culmination of an iterative engineering effort that began months earlier. Hardware security researcher Joe Grand first examined a tampered Ledger Nano X in August 2025 after a buyer in Thailand discovered anomalous internal circuitry inside a unit purchased from an online marketplace.¹ Grand found an auxiliary circuit board, an antenna, an LTE module, and an eSIM wired directly into the display connections.¹

Grand purchased eight additional Nano X devices from third-party sellers on the regional e-commerce platform Lazada and discovered matching implants in four of them.¹ The early units showed obvious physical anomalies, featuring hand-soldered wire bundles that connected the implant to the screen pins and stood out immediately upon opening the case.¹ Grand notified Ledger technical personnel on March 4, 2026, and demonstrated his findings at security conferences in April and May.¹

Subsequent iterations identified by independent investigators revealed a transition from manual assembly to industrial fabrication. Former Mt. Gox executive Mark Karpeles examined units obtained through online retailers, including a device shipped from Malaysia in shrink-wrapped packaging.¹⁵ Karpeles discovered a second-generation design that replaced the loose wires with an orange, flexible printed circuit board laminated directly over the main board.¹ To fit the assembly inside the casing, the assemblers had swapped the factory battery for a smaller cell.¹

A third-generation implant documented by Karpeles showed further refinement.¹ The flexible circuit was coated in black to match the genuine circuit board, and manufacturer markings were scraped off.¹ Rather than replacing the battery, the attackers thinned the protective display cushion behind the screen.¹⁵ The custom-designed antenna bore the silk-screened part designation AC-A2016-NANO-V1.1, indicating a formalized production run with dedicated radio-frequency engineering.¹

Traces to Infrastructure in East Asia

An independent security researcher based in Japan who analyzed ten tampered Nano X units purchased through online merchant listings identified five distinct hardware revisions.¹ The researcher observed that the embedded eSIMs retained cellular tower location identifiers from factory testing prior to distribution, allowing investigators to track initial connections to regional manufacturing hubs.¹

Microcontroller firmware extracted from the compromised hardware directed outgoing transmissions to command-and-control servers hosted at an Alibaba data center in Hong Kong.¹ Network analysis conducted by the researcher indicated that at least 90 distinct implants were communicating with the Hong Kong infrastructure in June 2026.¹ Two of the units analyzed in Japan had been dispatched from a shipping hub in Osaka tied to an address shared by multiple shell entities.

While early cases were confined to older Nano X hardware, newer models have also been targeted. Implants have surfaced in Ledger Flex devices, including a unit obtained at Singapore Airport, as well as Ledger Stax hardware featuring larger touchscreen interfaces.¹² The development indicates the attackers adjusted their circuit designs to accommodate the physical layouts of Ledger's newer product lines.

The Retail Distribution Vector

The physical compromises initially appeared limited to unauthorized online storefronts and gray-market resellers. However, the thefts executed on October 9 traced directly to authorized distribution channels. Blockchain analytics firm Bitquery identified approximately 315 drained accounts associated specifically with devices distributed by CryptoBilis, an authorized Ledger reseller serving Malaysia, Indonesia, and the Philippines.⁴ Tether subsequently froze $10 million in USDT connected to the fraudulent transfers.²

CryptoBilis halted all hardware sales following the disclosures and stated it was cooperating with inquiries.¹⁴³ Corporate records and public disclosures revealed that CryptoBilis co-founder Arravind Prabu and his partner quietly finalized a sale of the company in March 2026, stepping down from operational control under a non-disclosure agreement scheduled to expire in mid-October. Prabu directed inquiries regarding device sourcing to marketing director Nicholas Chang.¹

The incident expanded beyond Southeast Asia when an electronics customer named Johannes examined two Ledger Nano X units purchased from separate MediaMarkt retail stores in Germany.⁴ Both units contained internal antennas and hardware implants.² MediaMarkt, a consumer electronics retailer with roughly 1,000 stores across 10 European nations, suspended sales of Ledger devices across its MediaMarkt and Saturn locations following the reports.¹²

Ledger stated that its internal systems, software, and direct e-commerce fulfillment were not compromised.⁴¹ The company suggested authorized retail partners may have introduced tainted inventory by purchasing from unapproved secondary suppliers or returning opened customer returns to retail shelves without factory inspection.¹

Supply Chain Protections Under Review

Ledger chief executive Pascal Gauthier and chief technology officer Charles Guillemet stated the company is reviewing reseller oversight and chain-of-custody protocols across its distribution network.² The company warned all authorized distributors never to restock returned hardware and instructed customers who purchased devices through CryptoBilis to avoid setting them up.³ Users with active funds on suspected hardware were urged to generate fresh recovery phrases on verified, untampered units.²³

The incident underscores the structural vulnerability of physical supply chains in consumer cryptography. While software updates can remediate code flaws remotely, an auxiliary radio frequency transmitter soldered inside an enclosure cannot be neutralized through software patches. For users who rely on hardware wallets to protect substantial digital assets, physical chain of custody remains the critical point of failure.

Save this story

The record

40 sentences trace to 5 sources.

All 5Documents 1Records 0Reporting 4People 0

1. 1 ZD ZERO DAY Document · zetter-zeroday.com · 13 Oct 2026 Who Is Planting Backdoors in Ledger Crypto Wallets? See the source
2. 2 C CoinDesk Third-party reporting · coindesk.com · 13 Oct 2026 Ledger finds covert cellular implant stole hardware wallet recovery phrases from screens See the source
3. 3 TR The Record Third-party reporting · therecord.media · 13 Oct 2026 Ledger says hardware implant in cryptocurrency wallets stole recovery phrases See the source
4. 4 T trendintech.com Third-party reporting · trendintech.com · 13 Oct 2026 Ledger Confirms Hardware Implant, $93M Theft [2026] See the source
5. 5 H helpnetsecurity.com Third-party reporting · helpnetsecurity.com · 12 Oct 2026 Hidden implant in Ledger hardware wallets linked to $93M theft - Help Net Security See the source