News linked to both this project and an event.
Former Mt. Gox CEO Mark Karpelès (@MagicalTux) posted that Ledger Support (@Ledger_Support) stated on August 20 that the Secure Element chip can detect physical tampering; if extra hardware intercepts signals, the device will refuse to execute unsigned code or fail the Genuine Check. Karpelès pointed out that Ledger's own technical documentation explicitly states: if the original Secure Element is intact, the Genuine Check cannot detect unauthorized physical hardware modifications such as spy implants. The two statements contradict each other. He also noted that recent reports show over $90 million in assets were stolen precisely through this method of "extra hardware intercepting signals." Furthermore, in a March 2026 Ledger Academy article, Ledger had already published photos of spy implants installed inside multiple Ledger devices, including mass-produced complex PCBs, indicating they were long aware of this threat. Karpelès believes this conduct constitutes misleading promotion and cited that French law has specific regulations regarding misleading advertising.
According to official disclosures from Ledger, its security team, Ledger Donjon, is investigating Ledger signing devices (hardware wallets) sold by the Southeast Asian distributor CryptoBilis. It has been confirmed that the affected devices contain unauthorized hardware implants. All confirmed financial losses are linked to devices sold through CryptoBilis, with no evidence yet of theft from devices purchased through other channels. CryptoBilis has now suspended sales of Ledger devices. Investigative analysis reveals that the implant is located inside the device casing and is designed to read data displayed on the screen. During the user initialization setup, the implant decodes the 24-word mnemonic phrase displayed on the screen via a microcontroller and transmits it externally using a pre-configured eSIM card over an LTE network. The implant operates as an independent component and does not tamper with the Secure Element or the Ledger operating system, nor does it alter transactions or signatures.
According to disclosures by SlowMist Security Team CISO 23pds (@im23pds), researchers have indicated that Ledger hardware wallets may be susceptible to a PCB-level supply chain attack. The attack works by implanting a malicious module on the device’s screen data cable (such as the SPI bus) to passively monitor and record the mnemonic display process. The mnemonics are then forwarded to attackers via LTE/eSIM, allowing them to drain user assets. Since this spy module only performs passive read-only operations and does not interact with the firmware or Secure Element (SE), the device’s power-on self-test cannot detect any anomalies. The actual compromised security boundary is the plaintext bus between the MCU and the screen. To date, Ledger has officially launched an investigation into user fund loss incidents in Southeast Asia. The affected devices are suspected to be connected to Malaysian distributor CryptoBilis; Ledger has ordered it to halt all sales and shipments and has advised users to await official updates on the investigation.