After all these years in crypto, I’ve never seen a more sinister way to steal coins. The hackers didn’t even have to write any code—the hardware wallet already had an eSIM soldered inside.

A real user’s cautionary tale: bought the dip at $65K in June and picked up 80 BTC; transferred them to a Ledger a week ago; today, everything’s gone, down to zero. Paper profits of $1.38 million—and the original investment—vanished into thin air.

Over the past 24 hours, MistTrack has traced nearly $90 million in related losses. Tether has begun freezing USDT in the implicated addresses. Mark Karpelès, former CEO of Mt. Gox, personally took apart a Ledger bought in Malaysia and found spy hardware soldered where the screen’s padding should be: an LTE modem, antenna, eSIM, and microcontroller. The stickers were original and the shrink-wrap intact. There was no way to spot anything unusual without opening it.

/

❚ How the theft works—it’s simpler than you think

Hardware wallets are secure for one fundamental reason: isolation

  • The private key stays on the chip; it never leaves the device

  • Signing happens inside the device. The host is connected to the internet, not the wallet itself.

This attack directly shattered that assumption. An implanted microcontroller was connected to Ledger’s SPI bus and could read the characters destined for the screen. During initialization, the recovery phrase is displayed across several screens, one word at a time. The module sent those characters out over LTE. Once the attackers had the recovery phrase, your password strength and usage habits no longer mattered. They just had to wait for the right moment to drain the wallet with one click.

Put simply, you think you’re dealing with an isolated safe. But hidden underneath it is a phone, quietly watching everything displayed on the screen.

❚ Ledger’s security history

Those who’ve been in crypto for a while won’t be surprised that Ledger has had security incidents. Let’s go through them in chronological order ⬇️

1/ 2018: Early hardware research vulnerability

  • Researchers demonstrated that a Nano S could be tampered with before leaving the factory, bypassing the MCU bootloader

  • Mostly research-level issues; generally fixed by the company, with few real-world losses

2/ 2020: Massive e-commerce database leak

  • Over 1 million email addresses and more than 270,000 customers’ names, phone numbers, and addresses were exposed

  • The hardware and private keys were safe, but the incident spawned years of relentless phishing emails and fake official messages

3/ December 2023: Connect Kit supply chain attack

  • A former employee was phished, their npm account was taken over, and a malicious version was injected into every DApp that depended on the library

  • Stole $480,000–$600,000 in two hours

  • The hardware was fine, but for the first time, people realized that frontend dependencies could also be an attack vector

4/ January 2026: Third-party Global-e order data leaked again

  • The same old problem, continuing to fuel the phishing ecosystem

5/ April 2026: Fake Ledger Live scam on the App Store

  • Users were tricked into entering their 24-word recovery phrases; within a week, over 50 people were robbed of $9.5 million

  • Before this incident, this was the biggest single loss

6/ August 2026: Ethereum signing vulnerability LSB-023

  • Clear signing could be bypassed with the help of a malicious host, but there’s no evidence of real-world exploitation

7/ October 9, 2026: CryptoBillis supply chain attack

  • Tracked losses are close to $90 million—nearly 10 times the previous record

There’s a clear pattern. In all the previous incidents, either only metadata was leaked, or users had to do something foolish themselves (install a fake app, enter their recovery phrase). But this time, your recovery phrase never left your hands, your device never went online, and everything seemed normal. Yet your money was gone.

❚ Why Southeast Asia in particular?

CryptoBillis is an authorized Ledger reseller in Southeast Asia. Compared with ordering from the official website, buying through a reseller is a little cheaper and faster, and you avoid international shipping. This is a very common way to buy in Southeast Asia’s crypto community. I’m in Bangkok, and quite a few friends around me have used this channel.

The really sinister thing about supply chain attacks is that

  • There’s no need to breach Ledger itself

  • No user error required

  • Compromise any one reseller in the chain, and you can do harm at scale

Ledger has asked CryptoBillis to suspend sales and shipping, and advised customers who bought devices through this channel in the past 90 days to move their assets as soon as possible. But Ledger itself can’t confirm how many devices made it out or whether this was the only reseller affected.

❚ Practical tips

Now that we’ve covered how it works, here are some practical tips

1/ Buy hardware wallets only directly from the official website. Don’t use any third party.

  • Including links recommended by big influencers, resellers, Taobao, Xianyu, and friends who buy one for you

  • You might as well just burn the device instead of trying to save that little bit of money

2/ When your device arrives, don’t use any recovery phrase cards included in the box. Set it up from scratch.

  • Carefully verify the device using Ledger’s official Genuine Check

  • If necessary, send it back to the official company for a physical inspection

3/ Split large holdings across multiple wallets

  • Don’t keep all your eggs in one wallet

  • Spread assets across multisig setups or multiple addresses to raise the cost of a single point of failure

4/ Rotate your wallets regularly

  • Being safe today doesn’t mean you’ll be safe three years from now

  • It’s like changing the lock on your account

5/ Keep an eye on real-time monitoring from firms like MistTrack and SlowMist

  • There’s a delay between an incident happening and it being tracked. Switching wallets sooner could save you.

/

In a nutshell: The scariest thing about this incident isn’t the amount lost—it’s that it rewrites our default assumptions about hardware wallet security.

We used to think that as long as we didn’t do anything reckless, our money was safe. Now we have to add one more thing: the thing you bought might not actually be what you think it is.

Honestly, after writing this, I kind of want to put my Ledger away and switch to another brand. The market is already a complete mess, and then something like this comes along and scares the hell out of you.

(This article is based on information from MistTrack, public disclosures by Mark Karpelès, and Ledger’s historical announcements. It does not constitute advice; please verify everything for yourself.)