$86 Million Crypto Heist Linked to Ledger Signer Hardware Implant
Hardware implant in Ledger signers linked to $86M crypto heist.
Run Ledger?
Get an email when a reviewed story names Ledger, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
An unauthorized hardware implant discovered in Ledger signers sold through reseller CryptoBilis has been linked to the theft of at least $86 million in cryptocurrency. The implant, soldered onto the device's circuit boards, intercepts user data displayed on the screen, including recovery phrases, and transmits it to attackers via LTE. Ledger has advised users who purchased from the affected reseller to stop using their devices and consider moving assets.
The lesson from this incident
Full lessonAttackers compromised the hardware supply chain by physically implanting malicious components inside Ledger signing devices before they reached end users, enabling silent interception of recovery phrases via LTE transmission. This attack highlights the critical danger of purchasing security-sensitive hardware through unofficial or third-party resellers, where physical integrity cannot be guaranteed. Recovery phrases represent the ultimate cryptographic secret — once captured, all assets in a wallet are permanently at risk with no recourse. The incident underscores that even purpose-built security hardware provides zero protection if the device itself has been tampered with prior to delivery.
What helps against this
How we list vendors- Cyber asset inventory
You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.
- Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.
Indicators of Compromise
- malware — hardware implant