Alerted long before the crisis became public

Hardware hacker Joe Grand claims he identified identical LTE implants on eight Ledger Nano X devices purchased from Southeast Asian marketplaces as early as August 2025, and that he alerted Ledger to his findings in March 2026, according to information reported by Bitcoinist. That was several months before the broad supply-chain attack became publicly known in October 2026.

It is important to stress that the dispute primarily concerns communication and product distribution — not evidence that Ledger's underlying cryptography was broken. Ledger is now facing questions about how the company handled early warnings after reports of crypto thefts began to surface.

Ledger knew about attack months before millions vanished - Bilde 1

What actually happened in October

Between October 9 and 14, 2026, between 300 and 470 crypto wallets were drained simultaneously across TRON, Bitcoin, Ethereum, and Solana. Independent on-chain investigations, including by Bitquery, have estimated the combined losses at between $86 and $102 million. Tether reportedly froze around $10 million in USDT linked to the suspected addresses.

The attack vector was physical: the actors glued an extra circuit board containing an LTE modem, eSIM, and antenna beneath the casing of the devices — mainly Nano X units, though later reports have also mentioned the Flex model. The implant captured the 24-word recovery phrase directly from the display circuitry as it was shown during setup, and transmitted the unencrypted phrase over the mobile network.

The device passed every official authenticity test — because the security chip itself was never touched.

This is the core of the technical problem: Ledger's proprietary "Genuine Check" confirms that the Secure Element chip itself (an STMicroelectronics ST33) is genuine and running signed firmware. Because the implant only intercepted the display wiring without touching the chip itself, the tampered devices passed all official authentication routines.

Ledger knew about attack months before millions vanished - Bilde 2

Traced to a single reseller

The compromised devices were first traced to CryptoBilis, an authorized reseller in Malaysia, Indonesia, and the Philippines that had recently changed ownership. Later reports have also found tampered devices sold through the European electronics chain MediaMarkt and a store at Singapore Changi Airport.

$86–102 million
estimated loss in the attack
300–470
affected wallets
March 2026
when Grand claims he alerted Ledger

It should be noted that Joe Grand's claims so far are based on his own investigations and statements to journalists, and that Ledger has not publicly confirmed the full timeline in the source material available to us. The case should therefore be read as an ongoing dispute over accountability and disclosure procedures, not as a conclusively established fact.

The industry reacts

The crisis has accelerated a broader overhaul among hardware wallet manufacturers. Trezor's chief operating officer Danny Sanders announced on October 13 that the company will terminate contracts with selected third-party resellers by January 1, 2027, describing the move as a preventive strengthening of the distribution chain's security.

OneKey went even further: CEO Yishi Wang announced the same day that the company is cutting 95 percent of its authorized resellers, temporarily halting all third-party distribution, and offering free replacement devices to customers who purchased products via CryptoBilis between March and October 2026.

Competitor Tangem, which uses a sealed, screenless card type with no firmware update capability, has pointed to its design as a structural defense against precisely this type of physical tampering. The company states it had produced over 6 million units by the end of 2026.

This is not the first time Ledger has come under scrutiny. In 2020, a customer database containing names and postal addresses of around 272,000–292,000 customers was leaked, which in 2021 was followed by physical phishing shipments containing fake replacement devices. In December 2023, the company's software library Connect Kit was compromised via an NPM account, leading to a theft of around $600,000.

Cryptographic verification of the security chip itself cannot guarantee that peripheral hardware such as the display and circuit pathways have not been tampered with.

What this means for users

For Norwegian and Nordic crypto investors using hardware wallets, the key takeaway from this case is: always buy directly from the manufacturer or through officially authorized channels, and be wary of devices purchased via third-party marketplaces or resellers with unclear origins. The case also illustrates that even solid cryptography within the chip itself does not protect against physical tampering with surrounding components such as the display and circuit board.

Ledger has been contacted by several media outlets for comment on Joe Grand's claims and the timeline of the disclosure, but has not yet provided a full public response to all the details of the case.