Ledger Nano X wallets with hidden eSIM modems steal seed phrases, $93M drained

Crypto users have lost close to $100 million to hardware wallets that were tampered with before sale, heise online reports. The devices are Ledger Nano X units that look and behave like the genuine product but carry hidden extra electronics — including a tiny LTE modem — that leaks the owner's seed phrase to the attackers.

How the tampered wallets work

According to heise, the attackers never defeat the wallet's Secure Element, the tamper-resistant chip Ledger advertises as the heart of its security. Instead, they splice an additional chip into the connection between the Secure Element and the device's small screen. The implant reads the characters as they are drawn, an approach Tibane Labs, whose analysis heise cites, describes as an embedded variant of the classic Tempest eavesdropping technique.

When a buyer generates a recovery seed phrase on the modified device, the added chip captures the words shown on screen. Because hardware wallets are meant to stay offline, the attackers also fitted a miniature LTE modem, an eSIM module and a small antenna, all powered by the Nano X's own rechargeable battery. The captured seed phrase is transmitted over the mobile network, handing the attackers control of every wallet derived from it — without the Secure Element ever being broken.

Roughly $93 million drained so far

Heise reports that Ledger has acknowledged to at least one customer that their wallet was manipulated and that they suffered a financial loss, though the company has not confirmed the exact circumstances or the full extent of the damage. Blockchain observers quoted by heise have identified more than 300 affected wallets that were collectively emptied of roughly $93 million. The stolen coins are then exchanged and, at least in part, laundered through crypto mixers.

Suspicion falls on a Malaysian dealer

The suspected distribution channel is Cryptobilis, a wallet dealer active mainly in Southeast Asia and operating out of Malaysia. Ledger's advice, as reported by heise, is that anyone who bought from Cryptobilis in the past three months should stop using the device and move existing holdings to a different wallet. Ledger has barred Cryptobilis from further sales for now, and has instructed its dealers generally not to pass returned units on to other customers.

The catch is that many affected buyers cannot tell where their device came from. Tibane Labs examined a manipulated Ledger that was ordered through Amazon Japan from a Chinese seller but shipped from Malaysia.

Heise also relays reports from the crypto scene that Cryptobilis quietly changed ownership. Unverified screenshots suggest the shop has belonged since August to a Chinese man named JiaMing — a name that, depending on pronunciation, is either common in China or means "wrong name". The previous owners reportedly state that they no longer have anything to do with the business.

Three generations of implants

The devices now surfacing represent at least the third iteration of the scheme. In May, embedded-systems specialist Joe Grand presented a hand-modified Nano X at the Hardware.io conference: the perpetrators had swapped in a much smaller battery to make room inside the USB-stick-sized casing, leaving conspicuous wiring that only someone who opened the device would notice.

Tibane Labs describes a second, more professional generation that still relied on a replacement battery, and a third in which the added parts are precisely cut in professional series production and the original battery remains untouched. To create space, the attackers scrape away the foam that protects the underside of the screen. Apart from a thin antenna wire, an opened device looks factory-standard, which makes detection by ordinary users effectively impossible.

Why it matters

Hardware wallets exist precisely to keep private keys beyond the reach of remote attackers. This campaign shows that the weakest link is not the cryptography or the Secure Element but the supply chain between factory and buyer — and that an "offline" device can be turned into a beacon simply by adding a modem and an antenna. Until provenance checks for sealed hardware become routine, buyers should order directly from the manufacturer, treat dealer-sourced devices as suspect, and follow Ledger's guidance to move funds off any wallet purchased from Cryptobilis in recent months.