Rogue LTE implants in tampered Ledger devices enabled recovery phrase theft across six blockchains, resulting in approximately $93–102M in losses.
Security & Exploits ·
Ledger hardware wallets distributed through an authorized Southeast Asian reseller were compromised by physical implants inserted during supply chain handling, resulting in approximately $93 million in cryptocurrency theft across six blockchains. The attack, dubbed the Cryptobilis incident after the affected third-party distributor, involved unauthorized cellular modules embedded inside new devices that captured users' 24-word recovery seeds during wallet initialization and transmitted them unencrypted to attackers' servers via LTE, enabling complete account compromise and fund drainage.
The breach came to light on October 9 when hundreds of wallets drained simultaneously across Bitcoin, Ethereum, and Tron networks. Ledger's CTO and CEO confirmed the company is reviewing its sales channels, anti-tampering protections, and vendor oversight procedures following the incident. The company stressed that its official direct sales, firmware, and internal systems remain unaffected and advised users who purchased from resellers to move funds to newly generated wallets while investigations continue.
The incident raises questions about physical supply chain oversight across the hardware wallet industry. Ledger ordered the affected reseller to cease operations and invited industry researchers to help assess its tamper-detection and chain-of-custody controls, though the full scope of vendor changes and technical countermeasures remains to be disclosed.