Who Is Planting Backdoors in Ledger Crypto Wallets?

A coordinated campaign planted hardware backdoors inside Ledger hardware wallets sold through both shady online sellers and at least some authorized retail channels, leading to an estimated $102 million in crypto stolen from roughly 315 compromised accounts. Implants were discovered in Ledger Nano X, Flex and Stax devices sold by a Malaysian authorized reseller, CryptoBilis, and found in two devices purchased at MediaMarkt stores in Germany. Public disclosure accelerated the thefts as attackers rapidly drained funds from wallets already compromised. Ledger halted shipments from the reseller, warned partners to stop restocking returned items and said its infrastructure was not breached, but researchers and affected buyers raised questions about supply-chain integrity and the company’s response timeline after initial reports from hardware hacker Joe Grand were not immediately followed up.

Technical analysis shows the implants evolved from crude hand-soldered wires to much more sophisticated, stealthy circuitry. Early implants contained an extra board, antenna, LTE module and eSIM that captured recovery seed phrases by intercepting characters displayed on the device during initialization, then transmitted them over cellular networks to attackers. Later versions used custom flexible circuits hidden under components to avoid detection. Discoveries by Joe Grand in March and later by Mark Karpelès indicate a systematic, scalable effort to subvert wallets before distribution, exposing a broad vulnerability in physical supply-chain practices for secure crypto hardware.