Hardware Wallets With Hardware Spies: The Ledger Supply Chain Attack

If you bought a Ledger Nano X from a third-party seller in Southeast Asia, your hardware wallet might have come with a passenger. Ledger confirmed last week that compromised devices distributed through the Malaysia-based reseller CryptoBilis contained unauthorized hardware implants that silently captured seed phrases and transmitted them to attackers over LTE [1].

This is not a software bug. Someone physically modified Ledger Nano X devices, inserted a custom circuit board with a microcontroller and an LTE modem, resealed the packaging, and sold them to customers who had no idea their "secure" hardware wallet was phoning home to a stranger.

What was inside

Researchers at Tibane Labs tore down two compromised Ledger Nano X units and found two distinct implant variants. Both are disturbingly professional [2].

The first variant replaces the original battery with a smaller one to make room for the malicious circuitry. Under the battery sits an ST STM32G431KBU6 microcontroller (Arm Cortex-M4, 128 KB flash) paired with a tiny 2x2 mm eSIM and a shielded LTE module. The second variant is more compact and fits into the foam padding space under the OLED display, running on the original battery. In both cases, markings on the MCU and eSIM were scraped off to hide the part numbers.

The implant captures the device's display output and button presses, extracts the seed phrase during setup, and transmits it to the attacker via an LTE connection using the embedded eSIM. The antenna wire, running along the top edge of the device, is the only visible tell [3].

Tibane Labs noted that the implant uses a "designed, panelised flex PCB, the kind ordered from a board house, not a hand-built one-off." This is not someone soldering wires in a garage. Someone commissioned a proper PCB fabrication run for this attack.

How the attack works

The genius of this attack is that it does not touch the Ledger's Secure Element at all. The implant sits between the screen and the user, reading the display output and button inputs directly. Ledger's own Genuine Check feature, which verifies the authenticity of the device's Secure Element, cannot detect it. Ledger explicitly warns that Genuine Check "cannot detect added implants when the device's original Secure Element remains intact" [4].

Here is the attack chain:

• Attacker sources Ledger Nano X devices through legitimate channels, modifies them with the implant, and resells them at a discount through third-party marketplaces.
• Victim buys the device at a price below retail, often through platforms like Amazon Japan or Yahoo Auctions, from sellers shipping out of Malaysia [5].
• Victim sets up the wallet and enters their seed phrase on the device. The implant captures the display output and button presses.
• Implant transmits the seed over LTE to the attacker's server using the embedded eSIM.
• Attacker drains the wallet at their leisure, using the seed phrase to import the wallet into their own software.

Who found it

Mark Karpeles, the former CEO of the infamous Mt. Gox exchange and currently leading Karpeles Lab Inc., was among the first to publicly show the implant. He posted photos on X showing the device concealed behind the screen, noting it was "quite an evolution" from earlier versions with manually soldered wires [6].

Tibane Labs, a cryptocurrency research and development studio, independently confirmed the finding and published a detailed teardown report covering both implant variants. Their research page includes component-level analysis of the MCU, eSIM, and LTE module used in the attack [7].

Ledger's response

On October 9, Ledger launched an investigation after receiving reports of unexpected fund losses from users who purchased devices through CryptoBilis. The company asked CryptoBilis to stop selling and shipping Ledger devices. By October 10, Ledger confirmed that at least one impacted device contained an unauthorized hardware implant [8].

Ledger has since confirmed that all reported fund drains trace back to devices sold through CryptoBilis and described the affected volume as "limited." The company is working with authorities and advising anyone who purchased from this reseller to move their assets to a new Ledger device with a fresh seed [9].

Why this matters beyond crypto

The crypto angle is the hook, but the technique is the story. This is a supply chain attack at the physical layer. No software vulnerability was exploited. No zero-day. No phishing. Someone bought hardware wallets, opened them, added spy hardware, sealed them back up, and resold them. The devices pass authenticity checks because the Secure Element is untouched.

If this works on a Ledger, it works on any device where the attack surface includes physical access during distribution. YubiKeys. Smartcard readers. HSMs. Any hardware security module that passes through a reseller is potentially vulnerable to this kind of implant attack [10].

The trust model for hardware security devices has always assumed that the manufacturer is honest and the supply chain is intact. This attack breaks the second assumption. And it breaks it in a way that the manufacturer's own verification tools cannot detect.

What you should do

• Only buy from Ledger's official store or authorized resellers listed on Ledger's website. Avoid third-party marketplace sellers, especially those offering discounts.
• Inspect your device. If you own a Ledger Nano X purchased from a third-party seller, look for an antenna wire along the top edge of the device or under the battery. If anything looks off, stop using it immediately.
• Move your assets. If you bought from CryptoBilis or any unauthorized reseller, transfer everything to a new wallet with a fresh seed. Treat the old device as compromised.
• Check the serial number. Ledger's website lets you verify your device's serial number against their distribution records.

The compromised devices were selling for nearly half the retail price. If a hardware wallet deal looks too good to be true, it is. The discount is paid for with your seed phrase.