Hardware wallet maker Ledger says the $86M+ theft from hundreds of its wallets involved devices sold by reseller CryptoBilis and confirms a "hardware implant"

Hardware wallet security is now compromised by untrusted resellers and a physical device implant.

Hardware wallet manufacturer Ledger has confirmed that a significant theft, totaling over $86 million in cryptocurrency from hundreds of wallets, is linked to tampered devices sold by reseller CryptoBilis. The company stated that one affected user's device contained an "unauthorized hardware implant." This implant, appearing as a small circuit board under the screen, allegedly intercepts sensitive information like seed passphrases displayed during setup. An embedded SIM card then transmits this data to attackers, enabling them to drain user accounts. Ledger has requested CryptoBilis halt sales and is providing guidance for users to check their devices for tampering. The breach does not appear to involve Ledger's internal systems or wallets purchased directly from the company, with the issue primarily affecting users in Southeast Asia and linked to the CryptoBilis supply chain.

This incident highlights a critical vulnerability in the hardware wallet supply chain, moving beyond software exploits to physical tampering. The involvement of a reseller and a hardware implant suggests a sophisticated attack that bypasses traditional security measures, impacting user trust in the physical security of their devices. Ledger's response focuses on user verification and reseller cooperation, indicating a defensive strategy that relies on end-user diligence for now.

The breach will likely force a re-evaluation of hardware security protocols and supply chain verification processes across the cryptocurrency industry. Companies may need to implement more rigorous third-party vetting and potentially develop new methods for detecting physical tampering post-manufacturing. Users will face increased scrutiny over device origins and may demand more transparent verification steps from wallet providers.