The tampering involves a separate hardware component that reads 24-word recovery phrases from the device screen during setup and transmits them over LTE via a provisioned eSIM, Ledger's Donjon security team found. These implants do not modify the secure element or the operating system, meaning Ledger's "Genuine Check" may not detect them. On-chain researchers estimate losses of up to $93.2M across 300 to 500 addresses, most of which were drained on Oct. 9.
Wednesday, October 21, 2026
Story
Ledger Halts Reseller Sales in 7 Asian Markets Over Spy Implant Theft
Crypto7 days ago
Distributors in Hong Kong and six Southeast Asian nations must stop selling Ledger's hardware signers following the discovery of supply chain tampering. The company is reviewing reseller controls and anti-tamper protections after an unauthorized "spy implant" in devices sold by approved reseller CryptoBilis stole user seed phrases. While Ledger previously attributed all confirmed fund losses to CryptoBilis, Mark Karpelès reported a second compromised Flex device was found that had been purchased from Metapod at Singapore Airport.
Looking for more context or analysis?
Tilt chat provides reliable, tailored insights, alerts, and automations.