Reported Ledger Wallet Implants Steal Recovery Phrases Despite Genuine Checks

Physically modified Ledger hardware wallets reportedly captured 24-word recovery phrases during initialization and transmitted them through independent cellular modems. BreachNews reported that Ledger confirmed the implants and linked theft reports under investigation to devices sold through Southeast Asian reseller CryptoBilis, requesting sales suspensions. The implants monitored display communications without altering the Secure Element or operating system, allowing affected wallets to pass Ledger’s Genuine Check. Ledger’s published threat model explicitly documents this limitation: cryptographic attestation authenticates the Secure Element but cannot detect unauthorized physical additions when that component remains intact.

Independent reports estimated losses exceeding $90 million, with a Medium account citing approximately $102 million across 315 drained accounts; Ledger had not confirmed those totals, the tampering location, perpetrators, or full distribution scope. The Medium report also described multiple implant generations and separately modified Trezor wallets, but those details lack independent corroboration in the supplied reporting. Affected customers were advised not to initialize unused suspect devices and to transfer existing assets to trusted hardware initialized with a newly generated recovery phrase. For organizations holding cryptocurrency, the reported attack underscores that successful device attestation does not establish the integrity of the entire hardware supply chain.