Ledger Confirms Tampered Hardware Wallets Were Built to Steal Users’ Recovery Phrases

Hardware wallet maker Ledger has confirmed that malicious hardware was secretly implanted inside some of its devices to capture users’ 24-word recovery phrases and send them to attackers over a mobile network.

The discovery provides the clearest explanation yet for a series of cryptocurrency thefts linked to devices sold through Southeast Asian reseller CryptoBilis.

According to Ledger’s security investigation, the added hardware could watch the recovery words as they appeared on a Ledger device during initial setup, decode them, and transmit them using LTE connectivity and an embedded SIM.

That’s particularly serious because a recovery phrase is effectively the master key to a cryptocurrency wallet. Anyone who obtains it can recreate the wallet on another device and move the funds without needing the victim’s physical Ledger.

Ledger says the attack did not compromise its Secure Element, operating system, or transaction-signing process. Instead, attackers appear to have targeted something much harder for an ordinary buyer to verify: the physical supply chain between the manufacturer and the customer.

The investigation is continuing, and several important questions remain unanswered. Who modified the devices? Where in the distribution chain did the tampering occur? And exactly how many customers lost money?

What Exactly Did Ledger Find?

Ledger’s Donjon security team examined affected hardware and found an unauthorised electronic implant inside the device enclosure.

The additional hardware included a microcontroller capable of interpreting the recovery words being shown on the Ledger screen during wallet setup.

Once the words had been captured, the implant could send them outside the device using an LTE mobile connection and a provisioned eSIM.

That meant an attacker didn’t need to convince the victim to type their recovery phrase into a phishing website. The victim could follow what appeared to be the normal Ledger setup process.

The device generated the recovery phrase. The words appeared on the hardware wallet’s own screen. The user wrote them down. But hidden hardware inside the device was reportedly watching the same words.

Why Is the 24-Word Recovery Phrase So Important?

When a Ledger wallet is first set up, it generates a 24-word Secret Recovery Phrase.

Those words aren’t simply another password for the device. They’re the backup from which the wallet’s private keys can be reconstructed.

Ledger’s own explanation of seed phrases says someone who obtains the phrase can restore the wallet even without the original hardware device.

That’s why hardware-wallet users are repeatedly told never to photograph, upload, email, or share their recovery phrase.

But this incident introduces a different problem. Victims didn’t necessarily expose the phrase themselves. The malicious hardware was reportedly designed to capture it while the legitimate Ledger screen displayed it.

Once an attacker has those 24 words, the physical device sitting on the owner’s desk is no longer required. The attacker can recreate the same wallet elsewhere.

Was Ledger’s Secure Element Hacked?

Ledger says no.

Ledger hardware wallets use a Secure Element, a specialised chip designed to protect private keys and perform sensitive cryptographic operations.

According to Ledger, the malicious implant didn’t modify the Secure Element. It didn’t alter Ledger’s operating system either, and it wasn’t changing transaction details or manipulating digital signatures.

Instead, the implant targeted information at a different point. During the initial setup process, the wallet has to show the recovery phrase to the user so that it can be recorded securely. The attacker appears to have exploited that moment.

In other words, the vault itself wasn’t necessarily broken open. Someone secretly installed a camera inside the room.

This Was a Physical Supply-Chain Attack

That makes the incident fundamentally different from a normal software hack.

There is currently no evidence that Ledger’s central infrastructure, servers, or Ledger Wallet software were breached as part of this incident. Ledger describes what happened as a physical supply-chain attack.

A supply-chain attack occurs when a product is compromised somewhere between manufacturing and reaching the final customer. For a hardware wallet, possible stages include manufacturing, distribution, warehousing, shipping, and retail.

Ledger has not publicly established where the affected devices were modified. That’s one of the biggest questions still under investigation.

CryptoBilis Was Not Simply a Random Online Seller

This part of the story makes the incident especially uncomfortable for hardware-wallet users.

CryptoBilis wasn’t merely an unknown seller on an online marketplace. It was listed as an authorised Ledger reseller.

Ledger’s current official reseller directory still lists CryptoBilis in markets including Indonesia and Malaysia, but now marks its sales as temporarily paused. Ledger asked CryptoBilis to stop selling and shipping devices while the investigation continues.

That matters because one of the standard security recommendations for hardware wallets has always been to buy directly from the manufacturer or from an authorised reseller. The affected customers appear to have done exactly what many security guides would have advised them to do.

Ledger’s Genuine Check Could Still Miss This Kind of Implant

Ledger devices include a feature called Genuine Check, which allows Ledger Wallet software to cryptographically verify that the Secure Element inside a device is genuine. That remains useful for identifying counterfeit hardware.

But Ledger’s own security guidance makes an important admission: Genuine Check cannot necessarily detect unauthorised physical modifications around an authentic Secure Element.

Ledger explains this limitation in its hardware-wallet purchasing security guide.

A malicious device could therefore contain a genuine Ledger Secure Element and still have additional spying hardware installed elsewhere inside the casing. The cryptographic authentication succeeds because the original secure chip is real. The malicious implant is simply sitting beside it.

That’s one of the most important lessons from this incident. Genuine does not necessarily mean physically unmodified.

How Much Crypto Was Stolen?

Ledger has not confirmed an official total loss figure or final number of victims.

Independent blockchain investigators have linked tens of millions of dollars in suspicious transactions to wallets associated with the incident. Blockchain analytics firm Bitquery estimated that approximately $93.2 million may have been taken across 315 wallets and six blockchains. Another platform, YFarmX, estimated losses as high as $94.5 million across 521 addresses.

But those figures remain external estimates.

Tether Froze About $10 Million in USDT

There has already been some movement against the stolen funds.

CoinDesk reported that Tether froze approximately $10 million in USDT connected by blockchain investigators to the suspected thefts.

Stablecoin issuers such as Tether can freeze certain tokens at the contract level, which can sometimes stop attackers from moving stolen USDT. Bitcoin and many other crypto assets don’t have an equivalent central issuer capable of freezing funds. That means recovering the rest of the money could be significantly harder.

The full on-chain investigation remains ongoing.

Ledger Initially Linked Confirmed Losses to CryptoBilis

Ledger said that every confirmed fund-loss case it had connected to the October 9 incident involved devices sold through CryptoBilis. That initially suggested a relatively contained supply-chain problem.

Then another case emerged in Europe.

MediaMarktSaturn Suspended Ledger Sales

European electronics retailer MediaMarktSaturn temporarily removed Ledger products from its stores and online platforms across its markets after a customer in Germany reported finding suspicious hardware inside a device.

Ledger said it examined the affected signer and confirmed that it contained an unauthorised implant. Importantly, no loss of funds had been reported from that German device at the time of Ledger’s announcement.

MediaMarktSaturn told Cointelegraph that the products had been removed internationally as a precaution.

This development widened the investigation beyond the original CryptoBilis reports. It does not, however, prove that large numbers of devices sold through European retailers were compromised.

There Are Also Reports From Singapore, but They Remain Less Certain

Former Mt. Gox CEO Mark Karpelès separately said he discovered suspicious hardware inside a Ledger Flex reportedly purchased at Singapore’s airport.

CoinDesk reported the allegation, but Ledger had not publicly confirmed at that point that the Singapore device was connected to the same attack.

That difference is important. The CryptoBilis hardware implants have been confirmed by Ledger. The German MediaMarkt device was also confirmed to contain an unauthorised implant. Other reports should still be treated as allegations until Ledger or another credible technical investigation verifies them.

Does This Mean All Ledger Devices Are Unsafe?

No evidence currently supports that conclusion.

Millions of Ledger devices have been sold worldwide. The investigation concerns specific hardware that appears to have been physically modified somewhere in the supply chain.

Ledger says it has found no evidence that its core infrastructure, operating system, or Secure Element technology was compromised. That’s very different from discovering that every Ledger device contains a software vulnerability capable of leaking recovery phrases.

Still, the incident raises a difficult security question. Hardware wallets are designed partly to reduce the need to trust internet-connected devices. But users still have to trust that the physical hardware they receive hasn’t been intercepted and modified.

Self-custody removes some intermediaries. It doesn’t eliminate every form of trust.

Why This Attack Is So Clever

Most crypto thefts involving recovery phrases rely on social engineering. A fake support agent might ask for the phrase. A phishing website might tell a user to type it in. Malware might look for a photograph or text file containing the words.

Hardware wallets defend against much of this by keeping sensitive operations away from a general-purpose computer or smartphone.

But this attack appears to have gone after the trusted display itself. The user sees the words on the hardware wallet. That’s exactly where they’re supposed to see them. The problem is that malicious hardware inside the case may also be observing them.

That turns one of the wallet’s strongest security assumptions into the attack surface.

What Should CryptoBilis Customers Do?

Ledger’s guidance is particularly clear for people who bought devices from CryptoBilis.

If the device has not yet been initialised, Ledger says customers should not set it up or use it.

If the device has already been used, the safest response is more involved. Ledger advises affected customers to move their assets to a new trusted hardware wallet using a completely new recovery phrase.

The words completely new are crucial.

Do Not Simply Restore the Old Recovery Phrase on a New Device

Imagine you suspect an attacker has copied your 24 recovery words. Buying a new hardware wallet and entering those same 24 words into it doesn’t solve the problem. The attacker still has the phrase. They can still reconstruct the wallet.

Instead, the new trusted wallet should generate a fresh recovery phrase that has never appeared on the potentially compromised device. The user can then transfer the crypto from addresses controlled by the old recovery phrase to addresses generated from the new one.

Only after the assets are moved does knowledge of the old recovery phrase become useless for stealing those newly transferred funds.

What If Someone Has Already Lost Funds?

Ledger has encouraged affected users to work with law enforcement and preserve evidence.

The company has also warned users against opening potentially compromised devices before coordinating with investigators, since taking the hardware apart could interfere with forensic examination.

Victims should keep purchase receipts, serial information, packaging, and communications with the reseller where possible.

They should also be extremely cautious of people claiming they can recover the stolen crypto for an upfront fee. Large crypto security incidents almost always attract a second wave of scammers pretending to be support agents, investigators, or recovery companies.

Never Give Anyone Your Recovery Phrase

This incident doesn’t change one of the oldest hardware-wallet rules.

Your recovery phrase should never be given to customer support, entered into a website, or sent through WhatsApp, Telegram, email, or social media.

Ledger’s own recovery-phrase security guidance says no legitimate Ledger representative will ask for the 24 words. Anyone contacting victims of this incident and asking for those words should immediately be treated as a scammer.

Should You Still Run Ledger Genuine Check?

Yes. Genuine Check remains useful. It can identify whether the Secure Element inside a Ledger device is authentic.

But this incident shows why it should be understood as one security check, not a complete physical inspection of everything inside the wallet.

Ledger’s updated buying guidance explicitly says the Genuine Check cannot necessarily identify unauthorised physical additions such as spying hardware if the original Secure Element remains untouched. That limitation should now be much more widely understood.

Buying Directly Is Safer, but It Is Not a Magic Guarantee

Ledger recommends purchasing devices from Ledger itself or from authorised resellers. That remains sensible because random marketplace sellers introduce even more supply-chain risk.

But the CryptoBilis incident demonstrates that the words “authorised reseller” do not make physical tampering impossible. Ledger itself acknowledges in its security guidance that no global supply chain is completely immune to sophisticated interception or modification attacks.

Users should therefore treat unusual packaging, unexpected components, devices that appear previously configured, or suspicious setup instructions as warning signs. A legitimate Ledger should generate the recovery phrase during setup. It should never arrive with a recovery phrase already printed or provided.

Hardware Wallets Are Still Useful

It would be easy to look at this story and conclude that hardware wallets don’t work. That would be the wrong lesson.

Hardware wallets remain one of the strongest ways to protect cryptocurrency private keys from malware and online attacks. This attack was notable precisely because criminals apparently went to considerable effort to physically modify the hardware before users received it.

The incident shows that security is layered. A strong Secure Element helps. Secure software helps. A recovery phrase kept offline helps. But the physical device itself and the route it takes to reach the customer also matter.

The Bigger Question Is Who Controls the Supply Chain

Ledger CEO Pascal Gauthier has said the company is reviewing controls applying to both direct sales and resellers. Ledger CTO Charles Guillemet has also said the company is reviewing reseller controls and anti-tamper protections while inviting security researchers and hardware vendors to work on stronger chain-of-custody practices.

That may become the longer-term consequence of this incident. Hardware-wallet security has historically focused heavily on cryptography. The next battle may involve packaging, logistics, reseller inventory, component inspection, and ways for consumers to verify that the device in their hands is physically identical to the one that left the factory.

Blockwisely Take

This incident doesn’t show that Ledger’s cryptography was broken. It shows something more uncomfortable.

You can build an extremely secure device and still have a problem if somebody can modify that device before it reaches the customer.

The victims appear to have interacted with what looked like normal Ledger hardware. The recovery phrase appeared where users had been taught it should appear: on the wallet’s own screen. The Secure Element could still be authentic. The Genuine Check could still validate that chip. Yet another piece of hardware inside the case could reportedly watch the recovery words and send them elsewhere.

That’s a very different threat from clicking a phishing link.

For African crypto users, particularly those importing hardware wallets, the lesson is not to panic or abandon self-custody. It’s to broaden the definition of security.

Protect the recovery phrase. Verify the software. Check the device. And pay attention to how the hardware reached you in the first place.

Frequently Asked Questions

What happened to Ledger hardware wallets?

Ledger confirmed that unauthorised hardware implants were found inside some devices. The implants were designed to capture recovery phrases displayed during wallet setup and transmit them through an LTE mobile connection.

Was Ledger itself hacked?

Ledger says it has found no evidence that its central infrastructure, Secure Element technology, or operating system was compromised in this incident. The confirmed attack involved physical hardware modification.

What is CryptoBilis?

CryptoBilis is a Southeast Asian hardware-wallet retailer that was listed among Ledger’s authorised resellers. Ledger’s official reseller page currently shows sales through CryptoBilis as temporarily paused.

How did the malicious hardware steal the recovery phrase?

Ledger says the implant contained a microcontroller capable of reading and decoding the 24 words as they appeared on the device’s screen during setup. It then transmitted the information over LTE using an eSIM.

How much crypto was stolen?

Ledger has not confirmed a final figure. Independent blockchain investigators have estimated losses of roughly $93 million to $94.5 million or more, but that amount remains an external estimate rather than an official Ledger total.

Did Tether freeze any of the stolen crypto?

Yes. Tether reportedly froze approximately $10 million in USDT associated by investigators with the suspected theft.

Can Ledger Genuine Check detect this attack?

Not necessarily. Ledger says Genuine Check verifies the authenticity of the Secure Element but may not detect unauthorised physical hardware added around an otherwise genuine device.

What should I do if I bought a Ledger from CryptoBilis but never used it?

Ledger advises customers not to initialise potentially affected unused devices.

What if I already used the device?

Affected users should move their assets to a trusted wallet generated with a new recovery phrase. Restoring the potentially compromised recovery phrase on another device doesn’t make it safe.

Are Ledger devices bought in Africa affected?

There are currently no confirmed reports establishing that African customers or African resellers were affected by the confirmed incidents.

Should I stop using hardware wallets?

The incident doesn’t show that hardware wallets as a category are ineffective. It highlights a specific physical supply-chain risk and the importance of buying through trusted channels, verifying devices, and protecting recovery phrases.