Criminals are compromising Ledger Nano X hardware wallets by physically inserting covert communication modules, including a tiny LTE modem, an eSIM, and an antenna, into devices that appear genuine. These modified wallets are then sold to unsuspecting cryptocurrency users, undermining the advertised offline security of the product.
This image shows a Ledger Nano X wallet, the device targeted in the supply-chain attack where attackers add covert eSIM modules to steal seed phrases.
The attack works by intercepting the electrical signals between the wallet’s Secure Element chip and its display. An added chip reads the seed phrase as it is shown on screen (a technique identified by Tibane Labs as embedded Tempest) without touching the Secure Element itself. The captured phrase is then transmitted over mobile networks using the hidden eSIM, powered by the wallet’s own battery, allowing attackers to remotely obtain the secret and drain the associated cryptocurrency accounts.
Investigations link the scheme to over 300 compromised Ledger Nano X wallets that have collectively lost approximately 93 million US dollars in cryptocurrency, according to blockchain observers cited in the report. Ledger has acknowledged at least one customer loss due to a tampered device but has not disclosed the full scope, while evidence points to the wallet dealer Cryptobilis—operating mainly from Malaysia—as a likely source of the modified units, including some sold via Amazon Japan that were actually shipped from Malaysia.