Ledger says a hidden chip read recovery phrases off the screen and sent them out over a mobile network, and MediaMarkt Saturn stops selling its devices

Ledger has explained how the tampered hardware wallets behind this month's thefts worked. In an update posted on X on Tuesday, the company's Donjon security team said an unauthorized implant sat inside the casing of devices sold by CryptoBilis, a reseller in Southeast Asia, and read what was shown on the screen. When a device displayed its 24-word recovery phrase during setup, the implant decoded the words and sent them out over LTE using an eSIM. Anyone holding that phrase can rebuild the wallet elsewhere and move the funds, CoinDesk noted.

Ledger said the implant is a separate component that does not modify the device's Secure Element. It confirmed the implant in one affected user's device on October 10, and said every confirmed loss so far involves a device sold through CryptoBilis, which has stopped selling them.

The worry has now reached a major retailer. In a second update, Ledger said MediaMarkt Saturn stopped selling its devices in stores and online as of October 13, with Ledger's agreement, after one customer in Germany reported an implant. No funds were reported lost in that case.

Rivals are reacting too. Trezor said it has no evidence its devices were compromised, but it removed CryptoBilis from its reseller list and is shrinking its wider reseller network, The Block reported. OneKey is offering free replacements for devices bought through CryptoBilis.

Ledger has not confirmed the total stolen. On-chain researchers put it at up to $93.2 million across more than 300 wallets, CoinDesk reported. Chief executive Pascal Gauthier said the investigation into who tampered with the devices, and where in the distribution chain, is continuing.