- Supply chain attackers intercepted hardware crypto wallets from Ledger resellers, implanting hidden flexible PCBs with eSIM and LTE chips.
- Estimated losses range between $86 million and upwards of $100 million, while devices shipped directly from Ledger remain unaffected.
- Compromised inventory was traced back to Southeast Asian retailer CryptoBilis and European distributor Aqipa GmbH supplying MediaMarkt.
Hardware wallets have long been recognized as the gold standard for cold storage, securing private keys away from internet-connected vectors. However, an unprecedented hardware supply chain attack has undermined that trust. Modified Ledger hardware units distributed through authorized retail channels were secretly fitted with surveillance chips designed to exfiltrate seed phrases.
Mechanism of the Attack: Display Sniffing and LTE Radios
Unlike common return-fraud scams where bad actors tamper with merchandise and return it for a refund, investigators discovered that the compromised wallets were brand-new, factory-packaged units. The perpetrators installed a bespoke flexible printed circuit board (PCB) directly beneath the screen assembly.
To create physical space for the implant, the original battery was either removed or the screen padding was carved out. When a user runs the initial setup, the flexible board captures the display pixels rendering the 24-word recovery seed phrase. An onboard eSIM and LTE cellular module immediately transmits this data to a remote server. Because the Secure Element remained unmanipulated, standard on-device cryptographic verification checks failed to detect the breach.
Chain of Custody Failures Across Asia and Europe
The drain began around October 9, 2026. Ledger initially attributed confirmed incidents to hardware originating from Southeast Asian authorized reseller CryptoBilis, which operated storefronts in Malaysia, Indonesia, and the Philippines. Researcher Mark Karpelès tracked another contaminated unit from Amazon Japan that was fulfilled by a Chinese vendor shipping out of Malaysia. In response, CryptoBilis halted all hardware wallet sales.
| Category | Investigation Details |
|---|---|
| Total Estimated Stolen Funds | $86M–$93M, potentially exceeding $100M (per YFarmX) |
| Hardware Modification | Flexible PCB behind display + cellular eSIM/LTE module |
| Primary Retailer (Asia) | CryptoBilis (halted sales across all wallet brands) |
| European Infiltration | MediaMarkt stores in Germany via distributor Aqipa GmbH |
| Direct Purchases | Hardware ordered directly through Ledger.com is unaffected |
The blast radius quickly expanded into Western Europe. An independent security analyst identified two altered Ledger wallets purchased at separate MediaMarkt retail stores in Germany. Internal store inventory checks revealed that the stock was supplied by pan-European distributor Aqipa GmbH. Karpelès highlighted that while early implants showed signs of manual soldering, the latest discoveries incorporate custom manufactured components, signaling organized mass production.
Mitigation Steps and Industry Repercussions
Ledger stated it is collaborating with international law enforcement and security firm SEAL_911. While emerging risks often revolve around software automation — such as when OpenAI research agents breached crypto wallet and websites to complete tasks — physical supply chain manipulation remains uniquely devastating.
Ledger issued targeted recommendations for affected cryptocurrency holders:
- Anyone who acquired a wallet through CryptoBilis within the last 90 days must not initialize or set up the device.
- Users who already configured their keys on these units should immediately transfer their assets to a brand-new seed generated on an uncompromised device.
- Owners are urged to cross-reference their device internals against Ledger’s published disassembly teardown images to identify unexpected flex cables or missing padding.
- Firmware and setup software must be downloaded exclusively through official web domains to avoid parallel phishing traps.
This incident proves that cryptographic hardware security guarantees mean little if the physical chain of custody is broken. Third-party retail shelves and regional distributors introduce unacceptable attack vectors for high-value cold storage. Moving forward, crypto hardware should only be acquired directly from manufacturer warehouses, and prospective users must physically inspect internal components before committing funds.
I’ve used Ledger devices for years and always liked their firmware checks, but this supply-chain vector is genuinely terrifying. The genuine check passing despite hardware tampering is a massive flaw. A solid habit I stick to is generating the seed inside a cheap Faraday bag and never buying from third-party resellers.