Behind eight million devices sold, someone slipped a chip into a hardware wallet that can send text messages all by itself 🦖
🚨 行情变了群里说
On Tuesday, Ledger’s security research team, Donjon, confirmed that some signing devices sold through the Southeast Asian distributor CryptoBilis contained an unauthorized hardware implant. It was designed to monitor the device’s screen, capture all 24 words the moment a recovery phrase appeared, then send the data in real time over an LTE network using a built-in eSIM ⚠️
The most outrageous part of this attack is that it doesn’t touch the secure element, alter the system, or change transaction signatures. The device looks completely normal in your hands, while someone else has already made off with your coins.
Here are the numbers: the implant is a standalone component with its own power supply, and it relies only on the screen. So far, officials have confirmed one affected device. On-chain investigator Specter traced more than $86 million in suspected thefts, while another security outlet put the estimate as high as $103 million, across Ethereum, Tron, and Bitcoin. Ledger itself says it has sold more than eight million hardware wallets in ten years 📉
The timeline is short. On Friday, October 9, a user reported a loss. On Saturday, the company confirmed that one device had indeed been tampered with. It wasn’t until Tuesday that the attack method was made public. European retail chain MediaMarkt has now pulled Ledger products from its shelves, distributor CryptoBilis has halted all sales, and even Trezor and OneKey have rushed to distance themselves.
My take: this wasn’t a software hack; it was a supply chain breach. The biggest selling point of a hardware wallet is supposed to be that your private keys never go online. But if someone has already opened the device before it reaches you, “never goes online” becomes an empty promise. This also helps explain why more and more institutions simply hand their money over to custodians. You may be able to protect your private keys, but that doesn’t mean you can secure the delivery process.
One thing to watch: white-hat hackers have already pointed out that robust tamper detection at the factory and clear accountability throughout distribution would make this kind of attack far more expensive. So the real concern shouldn’t be one particular company, but every hardware distribution channel without end-to-end accountability.
Let’s talk in the comments: would you still dare to read your hardware wallet’s recovery phrase directly off the device?
I bring you the latest in crypto security every day—not just what’s happening, but the logic and opportunities behind the headlines 👀🚀
🚨 行情变了群里说
On Tuesday, Ledger’s security research team, Donjon, confirmed that some signing devices sold through the Southeast Asian distributor CryptoBilis contained an unauthorized hardware implant. It was designed to monitor the device’s screen, capture all 24 words the moment a recovery phrase appeared, then send the data in real time over an LTE network using a built-in eSIM ⚠️
The most outrageous part of this attack is that it doesn’t touch the secure element, alter the system, or change transaction signatures. The device looks completely normal in your hands, while someone else has already made off with your coins.
Here are the numbers: the implant is a standalone component with its own power supply, and it relies only on the screen. So far, officials have confirmed one affected device. On-chain investigator Specter traced more than $86 million in suspected thefts, while another security outlet put the estimate as high as $103 million, across Ethereum, Tron, and Bitcoin. Ledger itself says it has sold more than eight million hardware wallets in ten years 📉
The timeline is short. On Friday, October 9, a user reported a loss. On Saturday, the company confirmed that one device had indeed been tampered with. It wasn’t until Tuesday that the attack method was made public. European retail chain MediaMarkt has now pulled Ledger products from its shelves, distributor CryptoBilis has halted all sales, and even Trezor and OneKey have rushed to distance themselves.
My take: this wasn’t a software hack; it was a supply chain breach. The biggest selling point of a hardware wallet is supposed to be that your private keys never go online. But if someone has already opened the device before it reaches you, “never goes online” becomes an empty promise. This also helps explain why more and more institutions simply hand their money over to custodians. You may be able to protect your private keys, but that doesn’t mean you can secure the delivery process.
One thing to watch: white-hat hackers have already pointed out that robust tamper detection at the factory and clear accountability throughout distribution would make this kind of attack far more expensive. So the real concern shouldn’t be one particular company, but every hardware distribution channel without end-to-end accountability.
Let’s talk in the comments: would you still dare to read your hardware wallet’s recovery phrase directly off the device?
I bring you the latest in crypto security every day—not just what’s happening, but the logic and opportunities behind the headlines 👀🚀