Ledger revealed new details on October 13 about a supply chain tampering incident affecting its hardware wallets. The manufacturer confirmed that attackers installed hidden implants capable of capturing customers' 24-word recovery phrases and transmitting them over cellular networks.
According to Ledger's security research team Donjon, the implant operates independently within the device enclosure. During wallet setup, when the signer displays the 24-word recovery phrase on screen, the implant's microcontroller detects these screens, decodes the words, and transmits them via LTE using a provisioned eSIM. Ledger emphasized that the implant does not modify the Secure Element, operating system, or alter transactions or signatures.
All confirmed fund losses linked to the incident involve wallets purchased through Cryptobilis, a Southeast Asian reseller. Estimated losses have climbed from $86 million to $93 million, though Ledger stated these figures remain unverified and the total number of affected users is unconfirmed.
The company urged customers who purchased devices from Cryptobilis to take precautions, specifically advising those who have not yet activated their wallets to avoid setting them up.
In a related development, European retailer Mediamarkt Saturn temporarily suspended sales of Ledger devices following a report of an implant discovered in a customer's wallet purchased in Germany. Ledger noted that no fund losses were reported in connection with the Mediamarkt case. The temporary halt applies to both in-store and online sales while the investigation continues.
The incident has prompted increased scrutiny of hardware wallet supply chains. Trezor, a competitor to Ledger, announced it was scaling back its resale partners in response to the tampering concerns.
