Spy Module with eSIM

The supply chain attack targeting Ledger hardware wallets has escalated into sophisticated hardware espionage. An investigation into compromised units distributed by Asian reseller CryptoBilis revealed that physical implants discovered inside the devices did not merely log data locally—they autonomously transmitted recovery seed phrases to attackers over cellular LTE networks.

Anatomy of the Attack: Display Interception and LTE Transmission

Ledger’s security team identified the exact operational mechanism of the rogue module. Attackers physically modified the devices by integrating an unauthorized chip directly inside the casing:

• Video Signal Interception: The implant was hardware-wired to the wallet’s display circuitry, capturing screen data during initial device setup when the 24-word recovery phrase was generated and shown to the user.
• On-the-Fly Decoding: An embedded hidden microcontroller recognized the recovery screens and decoded the visual feed back into plain-text mnemonic words.
• Autonomous Uplink: The reconstructed recovery phrase was then transmitted to the attackers’ servers over LTE using a pre-configured, embedded eSIM.

Armed with the recovery phrase, the attackers could instantly clone the wallet on any external device and drain assets without ever needing physical access to the original unit.

Ledger engineers emphasized that the Secure Element chip, the proprietary operating system, and the cryptographic signing algorithms remained completely uncompromised. The attack bypassed internal security barriers by intercepting plaintext data downstream, just before it reached the user’s eyes. The company’s centralized infrastructure, backend systems, and online services were likewise unaffected.

Expanding Geography: Beyond Southeast Asia

Ledger officially confirmed the presence of the implant on October 10, initially linking all verified asset losses to devices sold through Malaysian distributor CryptoBilis. However, reports of tampered units quickly surfaced in other regions:

• Europe: An X user under the handle Johannes reported finding unauthorized wiring and cellular modules inside two devices purchased from separate brick-and-mortar locations of major European electronics retailer MediaMarkt. In response, MediaMarktSaturn pulled Ledger products from both retail shelves and online storefronts, launching an internal review alongside the manufacturer.
• Singapore: Former Mt. Gox CEO Mark Karpelès confirmed the discovery of a spy implant in a Ledger Flex purchased at Singapore Changi Airport. The buyer, Ben York, noticed suspicious physical tampering marks on the casing and handed the device over for forensic analysis prior to setup.

Ledger has refrained from confirming a direct link between the European units and the CryptoBilis supply chain breach, citing the ongoing investigation.

Estimated Losses and Industry Fallout

The scope of stolen funds is estimated in the tens of millions of dollars, though exact figures vary between blockchain intelligence firms:

Ledger stated that third-party damage estimates remain unverified and has not published an official total.

The fallout paralyzed CryptoBilis’s business operations: the distributor suspended sales and deliveries across Indonesia, Malaysia, and the Philippines, while closing its brick-and-mortar storefronts. Other hardware wallet manufacturers moved quickly to cut ties:

• Trezor removed CryptoBilis from its authorized partner directory, confirming that no tampered Trezor devices had been detected or reported.
• OneKey terminated its partnership and launched a compensation program, offering free replacements for any OneKey wallets purchased from CryptoBilis between March 1 and October 12, 2026 (claims accepted through December 31).

Security Recommendations

Users who acquired hardware wallets through unofficial channels or the compromised distributor should follow strict precautions:

1. Do not configure new units: If a device remains unboxed or uninitialized, do not perform the initial setup under any circumstances.
2. Immediate asset migration: If a compromised wallet is currently in use, transfer all cryptocurrency balances immediately to a verifiably secure address generated on a clean device with a brand-new seed phrase.
3. Never import existing phrases: Do not enter, recover, or reuse pre-existing seed phrases on suspicious hardware.
4. Preserve forensic evidence: If physical tampering is suspected, do not discard or disassemble the unit without consulting law enforcement; the hardware serves as vital evidence in the ongoing criminal inquiry.

The deployment of covert LTE transmitters highlights an evolving vector in hardware security. While previous industry discussions centered largely on laboratory-based physical exploits—such as Ledger Donjon’s research detailing laser fault injection attacks against Tangem card PIN protections—infiltrating retail supply chains with self-contained cellular implants demonstrates that even an uncracked cryptographic chip can be bypassed if the physical hardware is compromised before delivery.