Ledger's Supply Chain Has a Spyware Problem

Hardware implants in authorized-reseller Ledger wallets are stealing recovery phrases across Asia and Europe, with losses estimated above $86M.

By The crypto-money Desk

Ledger hardware wallets sold through authorized resellers are turning up pre-infected. The implants read the 24-word recovery phrase off the screen during setup, then transmit it through a hidden cellular connection — leaving Ledger's security chip untouched, allowing devices to appear genuine. [1]

On October 9, thefts surfaced involving Ledgers sold by CryptoBilis, an authorized reseller operating in Malaysia, Indonesia, and the Philippines, prompting a Ledger investigation. Ledger has confirmed at least one hardware implant. Investigator Specter estimates over $86M stolen; security outlet Yfarmx puts that figure at $103M, though Ledger has verified neither. [1]

The problem has spread well beyond a single distributor. Former Mt. Gox CEO Mark Karpelès confirmed an implant in a Ledger Flex bought at Singapore's airport. Tibane Labs examined compromised Nano X devices purchased through Yahoo Auctions Japan and Amazon Japan — the latter from a China-based seller shipping from Malaysia — with neither purchase linked to CryptoBilis. [1]

Europe has entered the picture, too. A German user found implants in two Ledgers bought from separate MediaMarkt stores, though Ledger says no funds were lost; MediaMarkt's parent has since halted Ledger sales internationally. Ledger maintains its own systems and direct sales are unaffected. [1]

The attack surface was never the software. It was the shelf.

Until Ledger maps every node in its reseller chain, the safest hardware wallet may be one bought directly — and even then, users should verify device integrity before entering a single word of their recovery phrase. [1]

The implants read the 24-word recovery phrase off the screen during setup, then transmit it through a hidden cellular connection.Bankless