A Hardware Wallet Betrayed Its Owners From Inside the Box. Your Crypto Estate Plan Inherits That Risk.

US$92.9 million is gone from hardware wallets that were never hacked in the way anyone expected. Blockchain intelligence firm Bitquery traced 311 drained wallets across five blockchains to Ledger Nano X devices sold by an authorised reseller that had been physically tampered with before they reached customers. A tiny circuit board inside each device read the recovery phrase off the screen and transmitted it over a mobile network. No phishing. No fake app. The wallet was already betraying its owner when it arrived in the box.

For Australians planning to pass crypto on to the next generation, this matters more than any exchange collapse. The entire premise of a digital-estate plan for crypto is that the seed phrase, the 12 or 24 words that regenerate a wallet, can be written down and handed to a beneficiary. If the device that generated those words was compromised before it was ever unwrapped, the inheritance plan inherits the compromise. ASIC's 2026 Gen Z Financial Behaviours report found 23% of Gen Z Australians now hold crypto, and hardware wallets remain the standard advice for anyone holding serious value they intend to keep for decades, and eventually, to bequeath.

What actually happened

Ledger confirmed on 12 October that an unauthorised hardware implant had been found inside at least one device sold by CryptoBilis, an authorised reseller serving Malaysia, Indonesia and the Philippines. The implant was a flexible circuit board soldered onto the Nano X, carrying a small microcontroller, a shielded LTE module and a 2×2 mm embedded SIM. The device's battery had been swapped for a smaller one to make room.

The attack worked by tapping the display lines of the device. When the owner set up the wallet and the 24-word recovery phrase appeared on screen, the implant reconstructed the phrase and sent it out over the mobile network, no Wi-Fi, no Bluetooth, no computer involved. The first the victim knew was an empty wallet.

By 13 October, Ledger had published full technical details and taken action: it halted CryptoBilis sales, asked resellers across Indonesia, Malaysia, the Philippines, Singapore, Thailand, Vietnam and Hong Kong to suspend sales, and told anyone who bought a device from CryptoBilis in the previous 90 days not to initialise it, and anyone already using one to move their assets to a new device with a freshly generated recovery phrase. The company said the incident was a localised distribution attack, not a systemic supply-chain compromise, and that its own manufacturing and direct sales channels were unaffected.

The money

The losses attributed to the tampered devices sit between US$86 million and US$93 million depending on whose tracing you follow. On-chain investigator Specter initially counted US$86.9 million across 98 addresses. Bitquery's fuller analysis found US$92.9 million across 311 wallets on five chains, roughly US$70.5 million of it in Tether on TRON, US$16.8 million in bitcoin, and the rest spread across Ethereum, BNB Chain and Polygon. Tether has frozen about US$10 million in stolen USDT, which blocks movement but does not return money to victims.

Days later, the story crossed from crypto media into retail: on 13 October, German electronics giant MediaMarktSaturn pulled Ledger devices from shelves across Europe as a precaution, after a customer reported finding suspicious modules in devices bought at two German stores. Those particular claims have not been independently verified, and Ledger has confirmed implants only in CryptoBilis-sold units.

The uncomfortable part for estate planning

The standard advice, buy direct from the manufacturer, verify the sealed box, never share your seed phrase, all still holds. But this incident shows the limits of individual diligence when the tampering happens upstream of the customer. You cannot inspect your way out of a supply-chain problem. What you can do is make sure a compromised device never becomes a compromised estate.

Three practices do most of the work. First, prove the wallet before you fund it: send a small amount, wipe the device, restore from the written phrase, and confirm the funds reappear, a tampered device that can exfiltrate your phrase can also be tested this way before real value lands on it. Second, never let a single device be the only place assets are recoverable from; the phrase on paper, stored with your will's supporting documents or your digital-estate instructions, is what your executor will actually use. Third, when you update your plan, treat old hardware the way you'd treat old passwords: assets that have sat on a wallet sourced years ago from an unknown middleman are the ones to migrate first.

And for the inheritance side: a beneficiary who inherits a hardware wallet and its phrase inherits whatever the device already gave away. Ledger's own guidance in this incident, move to a new signer with a newly generated recovery phrase, is exactly the instruction your estate documents should anticipate. The plan isn't "here's my wallet". It's "here's my phrase, here's how to test it, and here's how to move the assets to fresh custody safely."

There's a wider lesson here too. Hardware wallets exist because people stopped trusting exchanges with their keys. This attack flipped the trust problem one layer down the stack, from the platform to the supply chain. Your estate plan should not assume any single layer is safe. It should assume each one can fail, and make sure a failure in one doesn't empty everything.

What Ledger is doing about it

On 15 October, Ledger announced the Ledger Atom at its Op3n event in Paris, an US$849 Android-based device with tamper sensors that run on a separate battery even when the device is powered off, designed specifically to detect the class of implant used in this attack. It ships in (northern) summer 2027. Expensive, and no substitute for the practices above, but a clear signal that the industry now treats physical tampering as a live threat model rather than a theoretical one.

What Australians should do today

• If you bought a Ledger from a reseller in Southeast Asia or Hong Kong in the past 90 days: do not initialise it. Follow Ledger's published guidance.
• If you're already using a reseller-sourced device: move assets to a new device with a newly generated recovery phrase, and treat the old phrase as burned. If that phrase is written into any estate instructions, update those documents the same day.
• If you hold crypto you intend to pass on: run the fund-a-little, wipe, restore, verify test on the device your plan depends on, this week, not eventually.
• If your plan names a beneficiary's device or phrase: make sure the instructions describe migration to fresh custody, not just where the phrase is kept.

Sources: BleepingComputer · CoinDesk · The Hacker News · The Register · Cointelegraph