Ledger hardware supply chain attack may have been exposed before large-scale wallet transfers

Ledger hardware supply chain attack may have been exposed prior to large-scale wallet fund transfers, as former Mt. Gox CEO issued warning. According to Jinsecai, on October 10, Bitcoin News reported that former Mt. Gox CEO Mark Karpelès publicly disclosed physically tampered Ledger devices containing hidden monitoring implants, potentially inadvertently triggering coordinated fund transfers across multiple wallets. On October 8, Karpelès warned that counterfeit or tampered Ledger devices with hidden SIM cards were being sold on the market; these SIM cards can transmit stolen seed phrases. The alleged implants are capable of intercepting data sent to the device’s screen, thereby capturing the recovery phrase displayed during wallet setup. Such devices are reportedly still passing Ledger’s official authenticity verification, as the original secure element remains intact and the verification process cannot detect unauthorized physical modifications. A growing theory suggests attackers are collecting seed phrases from compromised devices and waiting to simultaneously transfer funds from multiple wallets. Karpelès’s warning, reportedly viewed approximately 90,000 times, may have alerted attackers that their activities had been exposed, prompting them to move the stolen funds. Karpelès stated that one compromised Ledger device he inspected originated from Malaysia, packaged in undamaged heat-shrink film, with an implant concealed beneath the screen. The suspected attack vector is a compromised hardware supply chain, not a cryptographic vulnerability. The connection between Karpelès’s warning and the subsequent wallet fund transfers has not been confirmed, nor has it been verified whether the same implants were responsible. If substantiated, this incident would demonstrate that even hardware passing manufacturer certification can compromise user asset self-custody if compromised.