- Trending
- Comments
- Latest
Attackers who secretly fitted genuine Ledger hardware wallets with cellular implants have stolen at least $91 million from 474 addresses, according to Galaxy Research, and the tampered devices still passed Ledger’s Genuine Check.
In a review published on October 16, Galaxy said the implants captured 24-word recovery phrases during setup and sent them over an independent cellular connection, so the attackers never had to break the device’s Secure Element.
Ledger’s Genuine Check is designed to verify that a device contains an authentic Secure Element. During the process, Ledger’s server issues a cryptographic challenge, which the chip answers with a signature that can be verified against the company’s manufacturing records.
The process establishes that the responding chip is genuine. However, it does not independently examine every component inside the device or guarantee that its physical enclosure has not been modified.
That distinction is central to understanding the Ledger hack. The attackers reportedly did not need to compromise the Secure Element, extract its protected secrets or forge its cryptographic response. Instead, they allegedly left the original chip in place while adding separate electronics capable of monitoring information displayed during setup.
Ledger Donjon, the company’s security research team, has documented this limitation in its explanation of Genuine Check. The authentication process cannot detect every unauthorized physical modification, including a spying implant installed while the original Secure Element remains intact.
Consequently, a device can pass the authentication test while containing additional hardware that threatens its owner’s security.
An apparently untouched package also provides limited assurance. A device may be carefully opened, modified and repackaged without leaving obvious external evidence of interference. Similarly, the wallet may continue performing its normal functions even if a separate component is collecting sensitive information.
The successful authentication result is therefore still useful, but its meaning must be understood correctly. It verifies the authenticity of a specific security component rather than certifying that every part of the device is original and uncompromised.
This distinction matters because users may interpret a successful Genuine Check as proof that a wallet is entirely safe. The Ledger hack demonstrates why hardware authentication and physical integrity must be treated as separate security questions.
Ledger previously confirmed that an affected device had been physically modified. Its subsequent explanation described an implant designed to capture the 24-word recovery phrase during setup and transmit the information over a cellular connection using LTE and an embedded SIM.
An examination of Nano X specimens by Tibane Labs provided further details about how the reported mechanism operated.
According to the examination, additional circuitry monitored the screen’s data lines, reconstructed the words displayed during setup and transmitted the captured information through a cellular modem. The mechanism did not require a camera to photograph the screen or an internet connection through the computer connected to the wallet.
This approach allowed the implant to operate separately from the device’s normal communication channels.
The recovery phrase is particularly sensitive because it serves as the master backup for a cryptocurrency wallet. Anyone who obtains the phrase can potentially restore the wallet on another compatible device and use the corresponding private keys to authorize transactions.
That means an attacker does not necessarily need continued physical access to the compromised hardware. Once the recovery phrase has been transmitted, the original device may no longer play any role in the subsequent theft.
The examinations also demonstrate why visual inspections may not reliably identify modified hardware. One design reportedly concealed additional components beneath the display while retaining the original battery.
As a result, loose wiring, an unusually small battery or changes to the external casing cannot be treated as universal indicators of tampering.
However, the findings from Tibane Labs apply to the specimens examined. They do not establish that every device connected to the incident contained an identical implant or entered distribution through the same route.
Galaxy Research estimates that approximately $91 million left 474 cryptocurrency addresses associated with the incident. Its analysis covered Bitcoin, Ethereum, Arbitrum, Polygon and TRON, but excluded BNB Chain, which other tracking efforts included.
The exclusion is significant because the research firm’s estimate does not represent the total losses reported across all investigations.
According to Galaxy’s findings, Bitcoin withdrawals began on October 7. Across the assets included in its analysis, approximately 88% of the estimated value, or roughly $80 million, moved within a single hour beginning at 05:00 UTC on October 9.
The concentration of withdrawals within that period supports the assessment that the transactions were coordinated rather than a collection of unrelated losses.
However, the timing alone does not establish precisely when each recovery phrase was captured, how long the attackers retained the information or whether all affected users encountered the same version of the implant.
The figure of 474 addresses also requires context. It does not necessarily represent 474 individual victims, 474 separate wallets or 474 physically examined devices. A single cryptocurrency holder may control multiple addresses, and blockchain transactions alone cannot establish which specific hardware device was used to access each wallet.
Galaxy’s $91 million assessment is therefore an on-chain estimate, not a final total confirmed by Ledger or a commitment by the company to compensate affected users.
The scale of the reported withdrawals nevertheless highlights the potential consequences of exposing recovery phrases. A single compromised phrase can provide access to assets held across supported blockchain networks, depending on the wallets and keys derived from it.
In its October 15 response, Ledger said the attackers purchased genuine devices, installed hidden components and returned them to distribution through resellers in Southeast Asia. The company said its chip, operating system and servers had not been compromised.
Ledger also reported requesting sales suspensions from authorized resellers and distributors in Southeast Asia and Hong Kong. Its teams inspected devices purchased from stores and warehouse samples, including checks conducted in Germany, and said the units examined were clean.
The company reiterated that returned devices must not be resold, even when they appear new and unopened. Its updated requirements instruct retailers to keep stock away from shelves and display areas, provide devices to customers only at the point of purchase, and report suspicious products promptly.
These measures are intended to reduce the likelihood that modified devices reach customers. However, the incident also shows why buying from an authorized reseller cannot be treated as an absolute guarantee of physical integrity: CryptoBilis, the reseller associated with the incident, had itself been listed as authorized.
Ledger’s guidance distinguishes between two separate risks. Genuine Check can help establish whether a device contains an authentic Secure Element, while stronger distribution controls are needed to reduce the risk of genuine devices being modified after leaving the factory.
Ledger’s October 13 investigation update advised buyers not to initialize unused devices associated with the incident or enter an existing recovery phrase into them. Users who had already initialized a device were advised to move their assets to a new signer with a new recovery phrase.
Anyone who believes they have a modified device or has lost funds should contact Ledger through its official support channels and coordinate with law enforcement before opening or shipping the hardware. Preserving a potentially compromised device may be important to an investigation.
Ultimately, the Ledger hack demonstrates that authentic hardware does not automatically mean uncompromised hardware. While cryptographic authentication remains an important security measure, it cannot replace physical integrity controls or protect a recovery phrase that has already been exposed.
For users, the most important distinction is between replacing a compromised device and replacing the compromised wallet credentials. If an attacker has obtained the recovery phrase, generating new keys and moving assets to a newly secured wallet is the critical step.
This article is for informational purposes only and does not constitute financial or investment advice. Users handling potentially compromised devices should follow the manufacturer’s latest security guidance.
Copyright © 2025 - The Bit Gazette.
