Hardware wallet supply chain compromised with malicious code, user recovery phrases stolen
Current overview (not historical)
A hardware wallet supply chain attack has been discovered, with malicious code planted in devices sold by CryptoBilis, leading to user recovery phrases being stolen and transmitted via cellular networks. Ledger confirmed unauthorized hardware implants, and researcher Joe Grand demonstrated that ordinary users would find such tampering extremely difficult to detect. The incident raises significant concerns about the integrity of hardware wallet supply chains for both beginners and experienced users.
Written with AI from the reporting · updated 10/23/2026
Expand the detailed fact route and sources
Story route
A station-by-station route from the first public evidence onward; every station carries its own evidence and uncertainty.
- 1Logistics observationOct 11, 00:00recorded Oct 14, 22:22single sourcerevised
硬件钱包供应链被植入恶意代码
Read original source ↗ CointelegraphReplay this moment in the explorerEvidence & revisions · 1 source records
- Subject：
- ledger
- Action：
- 设备被植入未经授权的恶意代码
- Object：
- 用户的恢复短语
- Occurred (fact side)：
- Oct 11, 00:00
- Published (valid side)：
- Oct 14, 19:59
- First seen (known side)：
- Oct 14, 22:22
Fact stationSingle source · one-sided claimRevisedCopy may have been revised later; time replay is bounded. Layer labels group reading only, not causation between layers.
- 2Unclassified fact stationOct 23, 20:26single sourcereport-time onlyrevised
硬件钱包安全风险暴露
Read original source ↗ CointelegraphReplay this moment in the explorerEvidence & revisions · 1 source records
- Subject：
- Ledger和Coldcard硬件钱包
- Action：
- 暴露安全漏洞
- Object：
- 用户资金和恢复短语
- Occurred (fact side)：
- not recorded
- Published (valid side)：
- Oct 23, 19:47
- First seen (known side)：
- Oct 23, 20:26
Fact stationSingle source · one-sided claimRevisedReport-time onlyCopy may have been revised later; time replay is bounded. Layer labels group reading only, not causation between layers.
Uncertainty marks flag where to check the sources; they are not proven causation.
Report timeline
Explore every side through dated source reports.
- CointelegraphRelated fact: single sourceFact occurrence time unverifiedSource report revisedCrypto executives debate if self-custody was designed for beginners
Report first recorded Oct 23, 20:26
Crypto executives are divided on whether self-custody was intended for beginners; Safe Labs CEO Rahul Rumalla said self-custody was "always meant for everyone," while Onramp CEO Michael Tanguma stated, "Self-custody was never designed with newcomers in mind." Approaches like multisignature wallets and seedless backups present trade-offs, with multisig adding complexity for beginners, and seedless wallets requiring users to safeguard physical devices, as confirmed by Tangem. Recent security incidents involving Ledger and Coldcard have highlighted weaknesses in hardware wallets, despite their recommendation for offline key storage.
Read original source ↗
- CointelegraphRelated fact: single sourceSource report revisedHardware wallet supply chain risks highlighted by Ledger implant incident
Report first recorded Oct 14, 22:22
Security researcher Joe Grand stated that ordinary cryptocurrency owners cannot realistically detect sophisticated hardware wallet tampering. This concern was amplified after Ledger confirmed an unauthorized implant in a device sold through CryptoBilis, a reseller in Indonesia, Malaysia, and the Philippines, which captured recovery phrases via cellular networks. Experts like Mati Greenspan noted that buying a hardware wallet introduces a new chain of trust from manufacturer to supplier, while Nick Neuman of Casa advised spreading risk across multiple providers, as avoiding all intermediaries is impossible.
Read original source ↗
Event discussion
Reader opinions are hosted on GitHub Discussions; posting requires a GitHub account. Comments are not verified facts.