Ledger losses from hardware implants cost investors over $86 million

The trap inside the "secure" device

For years, the crypto industry has insisted on one rule: do not store digital assets on exchanges. The best protection is a cold wallet, where the seed phrase (the secret set of words for restoring access) is kept exclusively by the owner. Many users followed these recommendations: they purchased devices from the well-known manufacturer Ledger, never entered their seed phrase online, did not photograph it, and did not store it in cloud services.

However, the threat actors operated differently. The hacker was not on your computer, not in the browser, and not in Telegram. He was hidden directly inside the wallet.

How the hardware spy worked

In October, Ledger officially acknowledged that some devices sold by the Malaysian reseller CryptoBilis had been modified. A separate microchip—a hardware implant—was embedded inside the casing. This scheme did not require hacking Ledger's security mechanisms. During the initial setup, the device displays the 24-word seed phrase on the screen. The implant simply captured the image on the display and button presses, recognised the words, and transmitted them to the threat actors via the mobile network. An eSIM was installed inside the chip for this purpose. Standard authenticity checks did not reveal anything suspicious, as the original firmware remained unchanged.

The scale of losses and market reaction

Total user losses have already exceeded $86 million. Southeast Asia has become a high-risk zone: Ledger asked sellers in the region and in Hong Kong to remove the devices from shelves. Suspicious units were also found in Europe. In Germany, a buyer disassembled two Ledgers purchased from different stores in the MediaMarkt chain and found foreign communication modules inside. Against the backdrop of these events, MediaMarkt halted Ledger sales across Europe. Trezor is reducing its reseller network, although it has not found any of its own compromised devices.

A cynical manipulation scheme

The fraud mechanism turned out to be cynically simple. No one "hacked" the device in the digital sense. It was physically disassembled, a spy chip was inserted, it was reassembled, packaged, and sold to a person as a means of protecting their funds. Some of these wallets were offered at nearly half the official price.

A new level of trust in the crypto space

Previously, the crypto market taught: do not trust exchanges, hold your keys yourself. Now a different question arises: can you trust the device on which these keys are generated. A new level of paranoia has emerged in the crypto sphere, which is justified. Buying a cold wallet is no longer a sufficient condition for security. It is now critically important to understand exactly where it was purchased.

Practical recommendations for asset protection

Wallets should be purchased only directly from the manufacturer, avoiding intermediaries and "bargain offers". A price half below the market rate today indicates not a discount, but the presence of a spy chip inside. The device must be inspected before the first power-on; Ledger has an official instruction on how to check its internal structure. For storing significant sums, it is recommended to use multi-signature: several wallets from different manufacturers, purchased in different places, none of which can withdraw funds individually. If a wallet has already been purchased from a suspicious seller, Ledger advises not to delay and immediately transfer assets to a new device with a new seed phrase.

A cold wallet protects you from the whole world, except for the person who sold it to you.