{
  "id": 14184186,
  "title": "Store-bought hardware crypto wallets had secret chips installed that enabled stealing crypto recovery phrases",
  "url": "https://urgent.news/2026/10/13/store-bought-hardware-crypto-wallets-had-secret-chips-installed-that",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-13T10:30:00.000Z",
  "source": {
    "name": "Tom's Hardware",
    "slug": "tom-s-hardware",
    "url": "https://www.tomshardware.com/tech-industry/cryptocurrency/store-bought-hardware-crypto-wallets-had-secret-chips-installed-that-enabled-stealing-crypto-recovery-phrases-usd93-million-and-counting-stolen-thanks-to-implanted-esim-and-lte-modules-in-ledger-wallets"
  },
  "original_language": "en",
  "account": "Cryptocurrency experts have long recommended purchasing hardware wallets like Ledger devices for enhanced security. However, a recent investigation has uncovered a disturbing revelation - certain Ledger resellers in Southeast Asia and Europe are smuggling compromised wallets containing eSIM and LTE modules designed to steal users' recovery phrases. At least $93 million has already been stolen from users' balances. Hardware purchased directly from Ledger remains unscathed. The first compromised wallet came from reseller Cryptobilis, which has since halted all hardware wallet sales. The affected unit originated from a store in Malaysia, though Cryptobilis also sells in Indonesia and the Philippines. Mark Karpelès, a researcher, has been investigating hacked wallets and discovered one purchased from Amazon Japan via a Chinese seller and shipped from Malaysia. Cryptobilis also sells other hardware wallets, but no contamination beyond Ledger has been reported. It has been revealed that a scam shop in Malaysia, listed as an authorized Ledger reseller for years, inserted microchips into every wallet, repackaged the device, and shipped it to unsuspecting victims. To prevent unauthorized access, Ledger advises users who bought wallets from Cryptobilis within the past 90 days to refrain from performing the initial setup, as this is where the private key exfiltration occurs. Those who have already completed the setup should transfer their assets to a new wallet with a new seed. The theft is executed by concealing a flexible PCB beneath the display assembly, capturing the pixels showing the private key entered during the initial setup, and transmitting the data through the eSIM+LTE combination for exfiltration. European reports have emerged from MediaMarkt, a well-known tech and appliances retailer, where Johannes found at least two hacked wallets. The units exhibited identical hardware modifications as the Asian counterparts, suggesting a possible connection between the Asian and European events. Johannes purchased a second wallet from a different MediaMarkt location, and it too was modded. Most hacked wallets discovered so far are confirmed to be new units rather than returns. Malicious actors often buy new hardware, return it to the store with modifications, and ship it to another unsuspecting customer. MediaMarkt employees have confirmed the stock information for one of the units, revealing it came from Aqipa GmbH, a Europe-wide distributor, indicating the blast radius may be larger than initially thought. Since this situation is still unfolding, Ledger has not issued any guidance, but it is likely to be similar to the previously mentioned steps. Mark Karpelès notes that earlier hacked wallets had hand-made implants, but the latest compromised units appear to have manufactured-to-order hardware bolt-ons, suggesting a potential production line intercepting Ledger wallets and producing hacked units in bulk. Ledger provides instructions for users to verify the physical integrity of their wallets, including component pictures for each model. Additionally, users should only download software from the official Ledger website to avoid falling victim to scam sites with malicious software.",
  "summary": "Store-bought Ledger hardware crypto wallets in Southeast Asia and Europe compromised in ongoing supply chain attack — $71 million and counting thanks to implanted eSIM and LTE modules",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}