Ledger Supply-Chain Attack: Hidden LTE Chip Stole Seed Phrases, $93M Lost

Ledger confirmed a hidden cellular implant inside devices sold by a Southeast Asian reseller silently captured users’ 24-word recovery phrases and transmitted them over mobile networks, draining an estimated $86-$93 million.

The Spy Chip Inside the Wallet

Ledger’s Donjon team found an unauthorized LTE-capable implant inside devices sold by CryptoBilis, an authorized reseller in Indonesia and Malaysia. The implant decoded the 24-word recovery phrase from the device screen during setup and transmitted it over LTE via a provisioned eSIM — bypassing the Secure Element entirely, so integrity checks could not detect it.

A Coordinated, Industrial-Scale Strike

A criminal syndicate spent months implanting custom hardware into genuine wallets and reintroducing them through resale channels, culminating in a coordinated strike on October 9 that emptied hundreds of wallets within seconds. On-chain researchers estimate $86-$93 million across 300+ wallets; Tether froze ~$10 million in USDT.

The Fallout

Ledger asked resellers across Southeast Asia and Hong Kong to halt sales. MediaMarkt paused Ledger sales in Europe; Trezor will shrink its reseller network. Affected buyers: do not initialize unused devices from CryptoBilis; move funds on used devices to a new recovery phrase.

Source: CoinDesk, BleepingComputer