Attackers hid tiny cellular radios inside brand-new Ledger hardware wallets, and the devices mailed out users' recovery phrases before anyone noticed.
The breach, dubbed the Cryptobilis incident, came to light on October 9 when hundreds of wallets were drained simultaneously across Bitcoin, Ethereum, and Tron. Nearly all the victims had bought their devices from CryptoBilis, an authorized Ledger reseller for Malaysia and Southeast Asia, which Ledger immediately ordered to halt sales. Investigators found a rogue LTE-equipped chip soldered into affected devices, sitting outside the main chip and completely invisible to Ledger's "Genuine Check" software. When a new owner generated or confirmed their 24-word seed phrase on-screen, the implant captured it and radioed it straight to the attackers, who cloned the keys and emptied the wallets, netting $93 million. Ledger CTO Charles Guillemet and CEO Pascal Gauthier have since confirmed the company is reviewing anti-tampering protections and reseller controls, and is inviting outside researchers to pick apart its supply chain.
This is the attack hardware wallets exist to prevent, just rerouted around the one layer Ledger doesn't fully control: the box between the factory and the buyer. Software checks are useless against a chip bolted on before the device ever boots, which is exactly why the fix Ledger is promising - tighter distributor tracking, bans on reselling returned units, approved-channel-only sourcing - is a logistics problem, not a cryptography one.
Ledger says its own firmware, infrastructure, and direct sales channel were untouched, which is cold comfort if your seed phrase came from a Southeast Asian reseller and is now sitting on a server somewhere with your name on it.