Ledger reviews sales controls after wallet implant theft

Ledger is reviewing how it sells and distributes its hardware wallets after investigators found an implant in devices sold through reseller CryptoBilis that captured recovery phrases and sent them to attackers over LTE. The incident shows how a physical change made before a wallet reaches its buyer can bypass protections built into the wallet’s software.

A hardware wallet stores the private keys used to authorize crypto transactions. During setup, its owner writes down a 24-word recovery phrase, which can restore access to the wallet. Ledger’s Donjon security team found that a microcontroller in the implant could detect and decode that phrase, then send it using LTE and a provisioned eSIM. BleepingComputer’s report on Ledger’s investigation says the implant did not alter the device’s Secure Element or operating system, and could evade Ledger’s integrity self-checks.

How did the implant get the recovery phrase?

The modified device read the phrase as the owner entered it during wallet setup or restoration. The implant was a separate component, so it could capture the phrase without changing the wallet’s firmware or transaction signing process. Once transmitted, the phrase could let an attacker restore the wallet elsewhere and move its funds.

The difference matters: the attack targeted the device before it reached the buyer, rather than Ledger’s direct sales systems or wallet software. Ledger said confirmed fund losses involved devices sold by CryptoBilis. Reports of modified devices from other sellers prompted a wider investigation, but Ledger said it had not confirmed losses tied to those reports.

What sales controls is Ledger changing?

Ledger asked resellers and distributors in Southeast Asia and Hong Kong to suspend sales while it investigates. It also directed sellers to keep devices off shelves and displays, store them out of sight, and hand them to buyers at purchase. Ledger’s response to the hardware implant attack says returned products must not be restocked for sale.

Those steps change how devices are stored and handled in shops. Keeping stock off display reduces the time a unit is left accessible before purchase; preventing returned units from going back into circulation addresses another point where a device could be altered or replaced. They do not establish who installed the implant or how many devices were affected.

For wallet owners, the attack exposes a gap between checking a device’s software and trusting its physical supply chain. A genuine check can verify parts of a wallet’s software integrity, but the implant described by Ledger sat outside the Secure Element and operating system. Ledger urged customers who suspect their devices were altered to contact support and send them in for examination.

Sources and documents

• BleepingComputer’s report on Ledger’s investigation — bleepingcomputer.com
• response to the hardware implant attack — support.ledger.com