Suspected hardware tampering linked to $86 million crypto theft from Ledger wallets

Summary

A hardware spy implant suspected of being hidden beneath the screens of Ledger wallets sold by the retailer CryptoBillis is linked to an $86 million crypto theft. The device is alleged to have intercepted seed phrases and exfiltrated them via an embedded SIM card. Ledger confirmed a single tampered device and requested that CryptoBillis halt sales during the investigation.

Why it matters

This incident challenges the fundamental assumption of hardware wallets: that physical, offline storage is inherently more secure than software-based custody. A supply chain breach at the retailer level implies that even “cold” devices can be silently turned into attack vectors, undermining trust in the cold storage model. The case also highlights how regional distribution channels—specifically a single retailer in Southeast Asia in this instance—can become a single point of failure for critical security hardware.

Highlights

• The implant is a small circuit board located beneath the screen that captures the seed passphrase displayed during initial setup.
• The embedded SIM card transmits the intercepted data to the attacker, enabling the draining of funds.
• No signs of compromise were found in Ledger’s own systems or wallets purchased directly; the attack is tied to the CryptoBillis retail channel.

Critical take

The article relies on user-shared photos and videos from X and Threads, without citing an independent forensic examination or a signed technical report from Ledger. Consequently, the $86 million figure and the claim of “hundreds of wallets” remain unverified. The mechanism—specifically how a SIM-equipped circuit was inserted into a sealed hardware wallet and evaded Ledger’s quality controls—is insufficiently explained. This renders the narrative more of an early-stage news report than a definitive technical analysis.