UPDATE: Ledger probe reveals LTE implants as thefts reach estimated $86M
CIE News ·
Ledger's security team found hidden implants transmitting recovery phrases over LTE in tampered devices, with an onchain investigator tracing over $86 million in suspected thefts.
Tampered Ledger devices were fitted with a hidden implant that transmits 24-word recovery phrases via LTE during setup, according to findings from Ledger's Donjon security team. As previously reported, Ledger requested resellers suspend sales across Southeast Asia and Hong Kong, an area now confirmed to cover Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong.
Onchain investigator Specter has traced more than $86 million in suspected thefts linked to the tampering, Decrypt reported, though Ledger stated it has not verified that figure. Ledger said confirmed losses involve units distributed through regional reseller CryptoBilis, while its own systems, infrastructure, and direct sales channels show no signs of compromise.
The hardware maker continues to investigate who modified the devices and where the supply chain breach occurred. In a separate move, rival maker Trezor announced it will end reseller authorizations on January 1, 2027, as a precautionary measure.