The offline crypto wallet that phoned home its own keys

On October 9, 2026, almost $5 million left three bitcoin addresses in one go. The money had been sitting on Ledger hardware wallets, devices that exist for one reason: to keep crypto keys from ever touching the internet. It most likely left through a SIM card that someone had hidden inside the casing.

The strangest part is not the amount. The owner of the money was a scammer himself. Blockchain analytics firm Chainalysis called him one of the biggest victims of the theft wave and traced where his 60 bitcoin came from. He paid people to write fake reviews, then demanded a fee before he would pay out what they had earned. On September 22 he moved the proceeds into three Ledger addresses. On October 9 someone else took them.

Chainalysis does not say where the scammer bought his devices. But that same day Ledger opened an investigation into losses reported by buyers in Southeast Asia. On October 10 the company confirmed that one victim’s wallet contained a foreign implant, and on the 13th it explained exactly what it had found: an extra microcontroller and a cellular modem with an eSIM, a SIM card soldered straight onto the board. A device built to live offline was quietly getting online and sending out its own keys.

Twenty-four words on a screen

A hardware wallet looks like a USB stick with a tiny screen and a couple of buttons. Inside is a secure chip that stores the secret key and signs transfers itself. Your laptop or phone only hands it a prepared transaction and gets it back signed. The key never leaves the chip, so malware on the laptop cannot reach it.

The scheme has an emergency exit it cannot do without. Wallets get lost or smashed. For that case, during first setup the device shows 24 words on its screen, and the owner copies them onto paper.

A wallet’s master secret is visible in plain text only at rare moments. Most often it is first setup, when the words appear on the screen, and less often recovery, when they are typed back in. The attack is built around the first of those moments.

A phone inside the wallet

On October 13, Ledger’s security team, Ledger Donjon, described how the implant works. A microcontroller inside the casing watches what appears on the display, decodes the seed words and sends them over LTE, ordinary mobile internet, just like on a phone. It leaves the secure chip and the firmware alone and does not alter transactions or signatures. The wallet notices nothing. It keeps faithfully guarding its key, while the 24 words that can rebuild that key are long since in strangers’ hands.

That is why the official authenticity check is useless here. According to Ledger, its Genuine Check feature cannot detect added components as long as the original secure chip is in place. It checks the chip. Not its neighbors.

These were no hobbyists. In the first variant, researchers at Tibane Labs found an STM32 microcontroller, an eSIM measuring 2 by 2 millimeters and a shielded radio module. To make room, the original battery had been swapped for a smaller one that powered both the wallet and the “spy.” In the second variant the chip markings had been scraped off, and the board was tucked under the display where a foam pad normally sits. It was a flexible board made in batches, factory style, not something soldered by hand at a kitchen table.

A shop with the right sign on the door

Ledger links every confirmed loss to a single seller, CryptoBilis, a Malaysian retailer. This was not some random flea-market reseller: as of October 9 it was listed as an official Ledger reseller in Indonesia, Malaysia and the Philippines. The investigation has not yet established who opened the boxes or where, on the way from the factory or in a warehouse.

But the story did not stay in Asia. In Germany an ordinary customer bought a wallet at MediaMarkt, a big consumer electronics chain, and found a “spy” inside. He lost no money, and the chain pulled Ledger from its stores and website. Mark Karpelès, the former head of the Mt. Gox exchange, wrote that he had found an implant in a Ledger Flex bought at a store in Singapore’s airport, though Ledger did not confirm a link between that device and CryptoBilis. Ledger itself asked sellers in six Southeast Asian countries and Hong Kong to take the wallets off the shelves until the checks are done.

Nobody knows how much was stolen in total. By the count of researchers going by tanuki42 and Specter, somewhere between $72 million and more than $86 million went to suspicious addresses. Ledger says plainly that these figures come from third parties and that it has not verified them. Tether issues digital dollars, known as stablecoins, and can freeze its own coins sitting at someone else’s address. It froze $10 million worth linked to the theft. So far that is the only named sum anyone has managed to stop along the way.

A key that cannot be changed

At Ledger, the authenticity check missed an extra circuit board. At Keystone, another hardware wallet maker, thieves stole the key behind such a check itself. On October 20 an attacker got into the company’s website through a flaw in a third-party data monitoring tool. Keystone said that data on almost 26,000 buyers from 2024 to 2026 was exposed: names, contact details, shipping addresses and order contents. Seed phrases and wallet keys, the company says, were not affected.

A list of home addresses of people who bought a device for storing crypto is dangerous on its own. In France robbers already show up at such people’s homes , and they take their leads from exactly this kind of leaked database. Some of the records should not have existed at all. Under Keystone’s own policy they were supposed to be deleted after 180 days, but the automated deletion tool broke. Nobody noticed. “We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure,” the company wrote.

The second loss is worse. The attacker also took a key that is built into every device at the factory so it can prove it is genuine during an online check. That key cannot be changed in wallets already produced. Which means a counterfeit carrying it would pass the very check meant to catch it.

Keystone decided to destroy 18,835 unsold devices, paused shipments and moved its web store to preorders. Wallets delivered before October 20 are fine to use if they pass authentication, the company says. Anyone who received a wallet after that date should get it checked further first. Keystone also warns that it will never send messages asking customers to return a device or migrate their funds: such messages come from scammers.

A chain you have to trust

Manufacturers are responding in different ways. Trezor found no tampered devices of its own, but from January 1, 2027 it is shrinking its reseller network, and some shops will lose the right to sell its wallets. OneKey dropped CryptoBilis as a partner and is replacing, free of charge, its own wallets bought there between March 1 and October 13, 2026.

Ledger advises not setting up CryptoBilis devices at all. Those who already have should move their funds to a new wallet with a new seed phrase and never enter the old words on a suspect device. Ledger says its own servers and direct sales were not compromised, and nothing so far contradicts that. Hence the most practical takeaway: the safest route is to buy straight from the manufacturer and never set up a wallet of unclear origin.

Plenty is still unknown. The number of victims has not been disclosed, and whoever soldered the boards has not been found. Nor is it clear how far the tampered units spread beyond one seller.

Changpeng Zhao, the co-founder of Binance, wrote on the day of the first reports that self-custody comes with extra responsibilities. Yet CryptoBilis customers had bought their wallets from an official seller, and no amount of care would have let them spot a board hidden under the screen.

The hardware wallet promised its owner that it would no longer need to trust an exchange or a bank. October showed that trust did not disappear but simply moved: now you have to trust the factory, the warehouse, the shop and the courier who held the box before you ever did.