Ledger Hardware Wallet Supply Chain Compromise

A covert hardware implant found in Ledger signers sold by Southeast Asian reseller CryptoBilis read users' 24-word seed phrases off the screen and transmitted them via LTE/eSIM, with estimated losses of $93.2M across 300+ wallets. A second compromised Ledger Flex was confirmed at Singapore Airport's Metapod store.

A second Ledger hardware wallet purchased from a different MediaMarkt location in Europe showed signs of tampering on unboxing, with calls for an immediate product recall.

Ledger devices sold at MediaMarkt locations across Europe have been found with spy chips (antenna + LTE modules) identical to those found in Southeast Asia. Multiple sources debate whether losses are ongoing or already contained.

A second Ledger device purchased from a different European retailer (Mediamarkt) has been confirmed as compromised, raising calls for an immediate product recall.

Ledger hardware wallets purchased from European retail locations (MediaMarkt) have been confirmed compromised in a supply chain attack, prompting calls for an immediate product recall. The attack bypasses the secure element entirely.

A second researcher confirmed Ledger hardware wallets sold at European retail locations are compromised after recording an unboxing from a different Mediamarkt store. Separately, tracked Ledger-hack funds were pushed through Tornado Cash three times and then into Zcash's shielded pool each time, prompting debate about the future viability of privacy coins.

Tampered Ledger devices with LTE spy implants have been found at MediaMarkt, Europe's largest consumer electronics retailer, confirming the hardware hack extends beyond Asia. This is a significant escalation of a known attack vector.

A Ledger device purchased from an official European reseller was found to contain spy implant hardware — previously thought to be an Asia-only issue — raising urgent hardware security concerns.

Ledger has officially confirmed a hardware implant was found in a user's device. The incident is no longer limited to Asia — a tampered device was purchased from an official European reseller.