Implants in Reseller-Sold Ledger Wallets Transmitted Recovery Phrases Over Mobile Networks, With Losses Estimated Near $100 Million

Ledger confirmed that some of its hardware wallets sold by CryptoBilis, a Southeast Asian reseller, contained hidden hardware that stole users' recovery phrases. When a buyer set up the device, the screen showed the 24-word recovery phrase. A small microcontroller in the implant recognized and decoded those words and sent them to the attacker over the mobile network through an embedded SIM card, CoinDesk reported.

The attack used physical tampering in the supply chain. It did not break Ledger's secure chip, which still protected the keys stored inside it. Instead, the implant copied the phrase at the one moment the device displays it to its owner. Anyone holding that phrase can rebuild the wallet on other hardware and move the funds. Rekt News described a sealed box that carried a mobile-network (LTE) modem and transmitted the 24 words by radio without the owner's knowledge.

Estimates of the losses differ. Rekt cites the analytics firm Bitquery, which counts about $102 million drained from CryptoBilis buyers. On-chain researchers quoted by ForkLog put the figure at up to $93.2 million across 300 wallets. None of the reports reviewed here mention a freeze, a recovery or an attribution. Investigators have not determined who tampered with the devices or at what point in distribution it happened.

The case widened in Europe. MediaMarkt Saturn, the large electronics retailer, stopped selling Ledger devices in Europe after a customer in Germany reported a tampered unit, The Block reported. Rekt says implants have since appeared in devices from MediaMarkt. The Block's reporting describes a single customer report. The evidence so far does not settle whether the German unit came from the same operation.