Tampered Ledger wallets sold by resellers can steal recovery phrases
Ledger is warning some reseller buyers to stop using affected wallets and move funds after hidden hardware was found to capture seed phrases.
Researchers have found tampered Ledger hardware wallets sold through resellers that can steal recovery phrases during first setup, putting users’ crypto at risk even when they buy physical wallets. The Asian case came from Cryptobilis, which has stopped selling hardware wallets, and Ledger says only customers who bought from Cryptobilis in the past 90 days should avoid initializing the device and should move funds to a fresh wallet if they already did. A separate wave of affected units turned up at MediaMarkt stores in Europe, where at least two brand-new wallets had the same modifications, and one traced back to distributor Aqipa GmbH. The devices appear to hide a flexible board under the display and use eSIM plus LTE hardware to send the captured seed data out. Reports say at least $93 million has already been stolen, while wallets sold directly by Ledger have not been affected so far.
Why it matters
This changes the risk picture for people who bought a physical wallet from a reseller and assumed the device itself made them safe. If the wallet was altered before sale, the first setup can expose the recovery phrase and leave funds vulnerable, which is why Ledger is telling recent Cryptobilis customers to avoid initialization or move assets to a new wallet. The wider finding also shows the problem is not limited to one seller, with affected units found in European retail stores and Ledger saying its direct sales have not been affected so far.
Keep or strike?
Does this story matter, or is it hype? Mark it before you see what everyone else did.
Sources
- Tom's Hardware