Ledger Implant Shows How Genuine Hardware Wallets Can Be Tampered With

A hardware implant in one genuine Ledger wallet captured its owner's 24-word recovery phrase during setup, creating a route to access crypto without altering the device's security chip or operating system.

The implant was confirmed in one affected device on Oct. 10. It read the phrase from the screen during setup, decoded the words with a microcontroller and transmitted them over LTE through an embedded SIM. The implant left the Secure Element, operating system, transactions and signatures unchanged, allowing the wallet to keep working normally.

The devices were acquired over several months, fitted with hidden components and returned to reseller channels in Southeast Asia. The tampering occurred after the devices left Ledger's control; the Secure Element, operating system and Ledger's servers were not compromised.

Every fund-loss case confirmed at the time involved a device sold through CryptoBilis, a Ledger-authorized reseller in Southeast Asia. No loss tied to a device bought elsewhere had been verified.

An on-chain tally put withdrawals at $102.0 million from 335 wallets across six networks as of 10:40 a.m. ET (14:40 UTC) Oct. 16, with dollar values based on prices from the morning of Oct. 9. The figure measures funds moved out of wallets, not confirmed net losses. The total number of affected users and the full value lost had not been established.

A recovery phrase can restore a wallet's accounts on another compatible device, so anyone who obtains the words can access those accounts without the original hardware. A hardware wallet safeguards the keys used to access crypto; the assets themselves remain recorded on a blockchain. In this case, the phrase was exposed as the device displayed it during setup.

Ledger's Genuine Check verifies that a device has an authentic Secure Element. It cannot detect physical modifications if the original chip remains in place, leaving a device vulnerable to additions around the chip even when the check passes.

Ledger asked authorized resellers and distributors in Southeast Asia and Hong Kong to suspend sales during the investigation. Devices examined in stores and warehouses showed no tampering.

Former Mt. Gox CEO Mark Karpelès previously said Ledger received suspected tampering reports before the Oct. 9 incident. Karpelès' earlier account of suspected tampering detailed those reports.