Somebody put a spy chip inside a crypto wallet. That part is real. Ledger confirmed that at least one affected device contained an unauthorized hardware implant, covert and physically inserted inside the enclosure. So yes, the allegation holds up, at least partly. But the scary version, where Ledger’s own systems fell apart, did not.
Here’s what was not confirmed. No flaw in Ledger’s chip. No compromise of its operating system. No breach of its servers or backend. No sign that the implant altered transaction signing. The secure element reportedly stayed intact in confirmed cases. Ledger describes this as a physical supply-chain attack that happened after devices left its control.
Ledger’s chip, OS, and servers held up. The attack was physical, and it happened after the devices left Ledger’s hands.
So where did it happen? Confirmed losses trace back to devices sold through a reseller, CryptoBilis, in Southeast Asia. Ledger said it stopped working with the reseller during the investigation. At least one case involved a Ledger Nano X. Later reporting suggested other models were being looked at, but official statements kept the confirmed count limited. Authorized resellers and distributors in Southeast Asia and Hong Kong also suspended sales while the investigation continued.
Now the creepy part. The implant reportedly intercepted what appeared on the screen during setup, including the 24-word recovery phrase. It matched the phrase character by character. Then it shipped the words off to an attacker using a built-in modem and eSIM over a mobile network. Not a software exploit. Just a tiny thief living inside the case.
Notice what the attack skipped. It did not crack the secure element. It went after the recovery phrase, which appears on screen during initial setup. That moment relies on user trust. The implant bypassed it.
The security lesson is blunt. Authenticity checks may not catch hidden hardware tampering after distribution. A genuine box doesn’t rule out internal modification. Supply-chain risk for hardware wallets stopped being theoretical, at least for the victims. Ledger advised affected customers to move their assets to new devices and generate new recovery phrases.
The investigation is still open. Public updates said additional impacted users were being contacted, so the final tally could change. For now, the official line stays narrow. A limited number of confirmed cases, one reseller, one method.
