Ledger Hardware Wallet Backdoors Linked to Reported $102M Crypto Theft Across 315 Accounts

Around $102M in cryptocurrency—including Bitcoin $BTC, Ethereum $ETH, and Tron—was reportedly drained from about 315 accounts connected to compromised Ledger Nano X wallets sold by Malaysia-based authorized reseller CryptoBilis, according to blockchain research firm Bitquery. Hardware researchers Joe Grand and Mark Karpelès documented that the implanted backdoors use custom flexible circuits, an antenna, an LTE module, and an eSIM to intercept recovery seed characters as they are sent to the wallet's screen during initialization and transmit them to attackers via nearby cell towers. While Ledger initially attributed the issue to a limited number of devices from CryptoBilis and halted the seller's shipments, a buyer in Germany reported discovering similar hardware implants inside two Nano X units purchased at separate locations of MediaMarkt, an authorized European retail chain. Users and researchers have also reported finding implants inside newer Ledger Flex and Ledger Stax devices, though Ledger stated there is currently no indication its own security infrastructure, systems, or services have been compromised. "We are reminding our authorized resellers and distributors to source products only through authorized channels and never to restock returned products." — Ledger