Ledger Nano X Supply Chain Attack: LTE/eSIM Hardware Implant Steals Seed Phrases

1. Basic Information

• Article Title: Ledger confirms spy chip implant behind wallet crypto thefts
• Publisher: BleepingComputer
• Publication Date: 2026-10-12
• Original Source: BleepingComputer
• Related Information Sources: Tibane Labs Ledger Nano X implant analysis, Ledger Genuine Check limitations
• Related Malware / Threat Group: Ledger Nano X hardware implant
• Related CVE: None
• Related Products: Ledger Nano X, CryptoBilis, STM32G431KBU6, LTE/eSIM implant
• Severity: Critical

2. Quick Summary

Ledger has confirmed that at least one compromised device obtained through CryptoBilis contained an unauthorized hardware implant. Separately, researchers have analyzed how modified Nano X devices intercept screen display data and transmit recovery phrases via cellular communication. The relationship between individual samples and the CryptoBilis supply chain remains unconfirmed.

3. Attack Flow

Confirmed Hardware Supply-Chain Theft

1. An attacker performs a physical modification on a Nano X, adding an implant while leaving the genuine Secure Element intact. The exact timing of the modification and the specific supply-chain stage are unconfirmed.
2. A user views and enters their seed phrase on the modified device using the buttons.
3. The implant intercepts the OLED display output and button presses to reconstruct the seed phrase.
4. The acquired information is transmitted externally using an LTE module and eSIM.
5. The attacker reconstructs the wallet from the seed and transfers the cryptocurrency to another address.

4. Attacker Position and Execution Location

• An attacker with physical access to the device during the hardware supply chain, reseller phase, or return and resale process.

5. Visibility for Victims and Administrators

• Users: Because the standard Genuine Check succeeds and the device operates normally, users may not notice any issues until a fund drain occurs. Antenna wires or chassis discrepancies serve as indicators.
• Administrators: Visible through purchase channels, serial numbers, device custody, wallet transactions, and victim clusters originating from the same reseller.

6. Conditions for Success and Failure

Success Conditions

• The user displays and enters their seed phrase on a modified device.
• The implant has power and cellular connectivity, allowing it to transmit intercepted data.
• The attacker uses the recovered seed to transfer the assets first.

Failure Conditions and Countermeasures

• Purchase sealed devices directly from Ledger or an authorized reseller, and do not allow returned items to re-enter circulation.
• Do not generate recovery phrases on suspicious devices. If a device has already been used, generate a new recovery phrase on a trusted separate device and transfer the assets to a new wallet.

7. Impact of Successful Attacks

• Theft of all wallet assets due to seed phrase compromise.
• Loss of trust in hardware wallets and reseller chains.
• Long-term concealment risks because software authenticity checks are bypassed.

8. Observable Logs

Below are candidate areas for internal investigation. Distinguish between facts confirmed in public disclosures and telemetry that must be verified internally.

• Email: Check for purchase, delivery, and reseller communications, as well as official notifications from Ledger. Distinguish these from phishing communications.
• Proxy / SWG / DNS: The hardware wallet's own LTE communications may not pass through the enterprise proxy. Check companion applications and support access.
• Endpoint / EDR: Check Ledger Live host USB connection history, wallet address changes, and suspicious support tools.
• Identity / IdP: Check exchange and wallet service logins, withdrawals, address changes, and MFA events.
• SaaS / Cloud: Check marketplace purchase histories, reseller batches, exchange withdrawal logs, and blockchain transactions.
• Network: Because nearby cellular transmissions typically do not appear in network logs, RF analysis or device teardown is required.

9. Attack Success Determination

Confirmed in Public Information

• Information Theft or Session Compromise Confirmed: Ledger confirmed an unauthorized implant in at least one device sold via CryptoBilis. Separately, technical analysis by researchers indicates the interception of display output and transmission via cellular communication. The relationship between individual samples and the CryptoBilis supply chain remains unconfirmed.

Internal Assessment Criteria

• Correlate requests, responses, processes, authentication, data access, and external transmissions chronologically to distinguish between contact and actual compromise.
• Do not conclude that an attack succeeded based solely on a single alert not backed by public information.

10. Investigation Playbook

• Investigation Trigger: Start from unexpected wallet drains, purchases from CryptoBilis or unauthorized sellers, or device anomalies involving antenna wires, weight, or battery differences.
• Initial Verification: Confirm purchase receipts, sellers, shipment origins, serial numbers, seed generation times, and wallet transactions.
• Device and Server Examination: Establish a chain of custody before powering on or disassembling the device, and preserve the Ledger Live host and USB history.
• Authentication and Cloud Examination: Check exchange accounts, wallet addresses, MFA settings, withdrawal destinations, and blockchain transactions.
• Subsequent Operations: Trace other devices from the same seller or batch, destination wallets, cellular indicators, and resale listings.
• Containment: Stop using suspicious devices, generate a new seed on an authorized device, transfer assets, and discard the old seed.
• Classification: Distinguish between device tampering, seed exposure, unauthorized transactions, and fund recovery feasibility.

11. Defense and Detection Ideas

• Single Events: Create indicators for purchases from unauthorized sellers, internal antenna wires, unexpected battery or weight characteristics, and unknown cellular components.
• Chronological Correlation: Chronologically map device purchases, seed entry, cellular transmission windows, fund drains, and destination wallets.
• Threat Hunting: Cross-reference purchase histories from CryptoBilis, Malaysian shipments, and Amazon Japan or Yahoo! Auctions with wallet losses.
• Log Limitations: Genuine Check and enterprise network logs cannot detect additional hardware implants. Physical inspections and blockchain analysis are necessary.
• Priority Countermeasures: Prioritize authorized procurement, isolation of returned goods, tamper inspections, migration to new seeds, and recording purchase chains.

12. Facts / Inference / Hypothesis

Facts

• Ledger confirmed that at least one compromised device obtained through CryptoBilis contained an unauthorized hardware implant.
• Reports of unexpected fund drains are linked to devices sold by CryptoBilis, and Ledger describes the impact scope as limited.
• Researchers analyzed that the implant captures display output and button presses to reconstruct seed phrases and transmits them to attackers via LTE connections and eSIMs.
• Tibane Labs analyzed two variants: one purchased from a Chinese seller on Amazon Japan shipping from Malaysia, and another purchased on Yahoo! Auctions Japan.
• One variant featured a smaller battery to accommodate a flex PCB, an STM32G431 MCU, a 2x2mm eSIM, and an LTE module, while the other retained the original battery and fit underneath the OLED display.
• Because the original Secure Element remains intact, the Ledger Genuine Check cannot detect the added implant.
• The exact timing of the modification, the supply chain pathway, and the perpetrators remain unconfirmed in public information.

Inference

• Returned or resold devices outside authorized channels cannot have hardware implants ruled out solely through software authenticity checks.
• Antenna wires, battery capacities, and internal chassis differences are strong indicators, but disassembly by general users carries risks of device damage and seed exposure.

Hypothesis

No additional hypotheses. Unverified items are listed in "14. Unresolved Questions and Additional Investigation".

13. MITRE ATT&CK Mapping

ID	Technique	Confidence	Basis
T1195.003	Compromise Hardware Supply Chain	high	Actual damage where a spy implant was added to a hardware wallet during the distribution process.
T1056	Input Capture	high	Hardware-level capture that reconstructs seed phrases from display output and button presses.

14. Unresolved Questions and Additional Investigation

• At which stage of the CryptoBilis chain was the device modified?
• The total number of impacted devices, total stolen funds, and the implant operators.
• Details regarding cellular carriers, destination infrastructure, and transmission protocols.

15. Impact on SOCs and Organizations

Because two samples purchased from Japanese marketplaces have been confirmed, organizations and individuals should treat Ledger Nano X devices purchased outside of authorized distributors as high risk. If recovery phrases have already been displayed or generated on a suspicious device, generate a new recovery phrase on a trusted separate device and transfer your assets to that new wallet. Do not continue using the old recovery phrase on a new device.

16. Summary by Role

• For SOCs: Chronologically correlate hardware purchase histories, fund drains, unknown LTE activity, and asset movements, treating them as wallet-related incidents.
• For Administrators: Stop using devices obtained outside authorized channels, generate new recovery phrases on trusted devices, and migrate assets.
• For Users: Do not set up items purchased from CryptoBilis or unauthorized marketplaces. If a device has been used, transfer assets to a wallet created with a new recovery phrase.