Seed-stealing LTE implant in reseller-sold Ledger wallets drained over $86M

A hidden implant confirmed in reseller-sold wallets

Ledger has confirmed that at least one of its hardware wallets, sold through CryptoBilis, an authorized reseller in Indonesia and Malaysia, contained an unauthorized hardware implant built to steal the device's recovery phrase. According to a RedEye Threat Intelligence report published on dev.to, pseudonymous blockchain investigator Specter estimates losses among Southeast Asian users at more than $86 million, though Ledger has not confirmed a victim count or a total figure.

The implant does not touch Ledger's Secure Element or its firmware, and it does not alter transactions or signatures. Instead, a separate component hidden inside the enclosure monitors the screen. During first-time setup, when the wallet displays its 24-word recovery phrase, the implant's microcontroller decodes the words and transmits them over LTE through a provisioned eSIM. Because the data leaves via a cellular connection, the attacker never needs access to the victim's phone, computer or Wi-Fi. Once the seed is in hand, the wallet can be rebuilt on any device and emptied, with no malicious transaction ever passing through the owner's signer.

That approach defeats the controls hardware wallets are built around. On-device transaction review is irrelevant because the theft happens at setup, not at signing time. And, as Ledger explained in an October 13 update, its Genuine Check verifies the integrity of the Secure Element but cannot catch unauthorized physical modifications elsewhere in the hardware when that chip remains intact — meaning a tampered device can still pass the vendor's own authenticity test. Ledger also warned that opening a device to inspect it can damage it, and told users to back up the recovery phrase first.

Three generations, several sales channels

The RedEye report says Ledger's findings match earlier research from Tibane Labs, which documented three implant variants, each more capable than the last. The third generation did not come from CryptoBilis: the researchers bought it on Amazon Japan from a third-party seller based in China, and the parcel shipped from Malaysia. The researchers noted that a mainstream marketplace listing, a seller in one country, a shipment from another and packaging indistinguishable from genuine stock left buyers with no way to spot the difference.

Europe saw a case as well. Ledger said electronics retailer MediaMarkt Saturn paused Ledger sales in its stores after a customer in Germany found an implant; no funds were reported lost. Per the report, the only confirmed drains remain in Southeast Asia, and Ledger has not verified any theft tied to a device bought elsewhere. The company is still investigating who tampered with the devices and where in the distribution chain it happened.

Vendor and reseller response

Ledger paused sales through CryptoBilis, Shopee Mall in Malaysia and the Philippines, and LazMall in the Philippines, though the report notes Ledger has not said whether every one of these pauses is tied to the incident. On October 13 it asked resellers and distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales and pull devices from shelves. It also told resellers to source stock only through authorized channels, never to restock returned products, and stated that it has no indication its own infrastructure or services were compromised.

Ledger's guidance to buyers is direct: anyone who bought from CryptoBilis in the past 90 days should not initialize a device they have not yet set up, and those who already did should move their assets to a new Ledger device with a fresh seed. CryptoBilis has halted all hardware wallet sales pending the investigation. Its customer alert also covers an older, cruder scam, warning that a wallet arriving with a recovery phrase already printed or written on a card is unsafe — though the implant is worse, since victims generate the seed correctly on the device and are compromised anyway.

Both companies warn that neither will call, message or ask users for a recovery phrase or PIN, and that offers to recover lost funds are almost always scams — a fraud wave that reliably follows incidents of this size.

Why it matters

This is not only a crypto hobbyist problem. Treasuries, exchange cold storage and custody desks often hold assets on hardware signers bought like any other peripheral, from whichever reseller or marketplace has stock. The incident shows that authorized reseller status is no guarantee a device was untouched along the way, and that marketplace listings can carry modified hardware that looks identical in the box.

The broader lesson applies to any trusted hardware: secure enclaves and firmware attestation protect only what sits inside their boundary and reveal nothing about extra components placed beside it. A display that shows secrets in plaintext is an attack surface silicon attestation cannot see, and a cellular radio hidden inside the case eliminates the air gap that hardware wallet threat models usually take for granted.