Ledger Nano X Supply Chain Breach Steals $93 Million via Implanted Cellular Modules

We are tracking a major hardware security breach affecting Ledger Nano X wallets sold through third-party channels in Southeast Asia and Europe. Buyers who purchased these devices from specific resellers face a direct risk of losing their cryptocurrency holdings because the hardware itself has been compromised. This incident highlights a critical vulnerability in the supply chain for popular hardware wallets, meaning that source of purchase determines the safety of your funds.

Implanted eSIM and LTE modules in compromised wallets steal recovery phrases

The compromised devices are Ledger Nano X units that have been intercepted and modified by criminal actors before reaching consumers. These modified wallets contain implanted eSIM and LTE modules hidden beneath the display assembly. The hardware uses a flexible printed circuit board to capture the pixels displayed on the screen during the initial setup process. This mechanism allows the device to record the user's private recovery phrase as it is entered for the first time.

The stolen data is exfiltrated from the device using the embedded cellular communication modules. Reports indicate that at least $93 million in cryptocurrency has been siphoned from user balances through this method. The implants appear to be manufactured to order, suggesting a coordinated production line intercepting shipments. Affected devices have been identified in Southeast Asia through reseller Cryptobilis and in Europe through MediaMarkt.

Ledger advises that hardware sold directly by the company remains unaffected by this breach. Users who purchased a Ledger Nano X from Cryptobilis in the last 90 days should avoid performing the initial setup. Instead, they should move any existing assets to a new, secure wallet immediately. The company recommends checking the source of purchase to verify if a device was part of the compromised supply chain.