Full Breakdown
Ledger and Trezor hardware wallets face supply-chain tampering; manufacturers cut reseller networks
By Drooid · · How we work
Core Incident Overview
In late 2025 and early 2026 physical implants were discovered in cryptocurrency hardware wallets sold through third-party channels. Researchers found spy modules inside Ledger devices purchased from Southeast Asian reseller CryptoBilis and European retailer MediaMarkt. The modules read the 24-word recovery phrase during setup and transmitted it via an embedded LTE eSIM, allowing attackers to drain the wallets. Reported losses range from $70 million to over $103 million across hundreds of addresses.
Hardware hacker Joe Grand reported implants in two discontinued Trezor devices—a Model T bought on Facebook Marketplace in Canada and a Trezor One from a TikTok shop. The microcontroller was replaced with a chip pre-programmed with seed phrases, enabling the attacker to guess the recovery seed after generation.
Background & Context
Supply-chain tampering of crypto wallets has been a concern for years. Three years ago Kaspersky Lab flagged a fake-wallet implant in a Trezor unit sold on a Russian marketplace. Ledger’s security team, the Donjon, later published a technical analysis of the LTE-enabled spy module. The recent wave prompted manufacturers to reassess reseller relationships.
Data & Statistics
- Estimated financial loss: $86 million (Ledger report), $90 million, $93 million, $102 million (Bitquery analysis of 324 wallets), and $103 million (independent analyst).
- Affected addresses: “hundreds of cryptocurrency addresses” and 324 wallets (Bitquery).
- Devices examined: Ledger Flex, Nano X, Nano S Plus, Trezor Model T, and Trezor One. Both Trezor models are discontinued but will receive software updates until 2031 and security updates until 2036.
Official Statements & Responses
Ledger CTO Charles Guillemet urged users who suspect tampering to follow the company’s inspection guide and back up recovery phrases before opening a device. Ledger CEO Pascal Gauthier said the tampering is a “risk for the whole industry” and that the firm is reviewing direct-sale and reseller controls.
OneKey echoed Trezor’s stance, stating that it has removed CryptoBilis from its reseller network and halted onboarding of new resellers.
On-the-Ground Reports
- A Ledger Flex purchased at Singapore’s Changi Airport contained the same LTE spy module found in CryptoBilis devices, according to investigators Mark Karpelès and Ben Yorke.
- German technician Johannes documented two MediaMarkt-sold Ledger units with identical implants, tracing one to distributor Aqipa GmbH.
- The Trezor Model T from Facebook Marketplace displayed a seed phrase generated by malicious firmware; the buyer noticed a $50 unauthorized transfer.
- The Trezor One from a TikTok shop exhibited the same microcontroller replacement, leading to a suspicious outflow of funds.
Conflicting Reports & Gaps
Loss estimates differ: Bloomberg cites “more than $90 million,” Bitquery calculates $102 million, while other analysts project up to $103 million. Ledger has not confirmed a total number of affected users, and no public reports of tampered devices have emerged from the United States. The extent of tampering beyond CryptoBilis-linked units remains unverified, with European and Singaporean cases still under investigation.
What’s Next
Ledger continues to review reports of implants in devices sold outside CryptoBilis and to trace the point of tampering in the distribution chain. Both Ledger and Trezor have pledged to share further findings as investigations progress, and they are tightening reseller vetting processes to mitigate future supply-chain risks.