Oct 16, 2026 · 45 min
Hardware-wallet implants expose the weak link in self-custody
Ledger Wallets Were Drained of $100 Million. Is Self-Custody Still Safe?
The incident shows that self-custody can fail before a device reaches its owner, shifting attention from wallet software to sourcing and supply-chain security.
- 1Attackers modified genuine Ledger devices to capture 24-word recovery phrases during setup and transmit them through cellular connections.
- 2Compromised devices appeared across reseller and distribution channels, making provenance and tamper evidence central to hardware-wallet security.
- 3The guests argue that self-custody remains safer than many internet-connected alternatives, but only with trusted sourcing and layered defenses.
Don't miss
Mark Karpelès demonstrates how to open a Ledger Nano X and check its test points for evidence of an implanted component.
The brief
Mark Karpelès describes implants hidden inside genuine Ledger devices, while Laura Shin frames the investigation and the emergency response for affected crypto users.
The implant watches the screen during setup, captures the 24-word recovery phrase, and sends it over cellular connectivity—turning a trusted device into a covert transmitter.
The trail runs through authorized resellers and logistics channels in Southeast Asia and Europe, raising questions about where tampering occurred without accusing a specific reseller’s new owners.
The guests weigh direct purchases against reseller convenience, then call for stronger vetting, tamper evidence, and better device-integrity checks rather than abandoning hardware wallets.
Mark demonstrates how to inspect a Ledger Nano X for implant evidence, while the response advice is practical: treat tampered devices as compromised and move assets securely.
The broader conclusion is uneasy but measured: self-custody still limits many online risks, yet its security depends on the entire path from manufacturer to owner.
What was said on this episode
15 statements · 3 positive · 10 negative · 2 neutral
The implant records each recovery-phrase word during device setup
“the implant will also be watching, taking note of every single word”
Listen at 6:36
The implant transmits captured recovery information to attackers via cellular connectivity
“the implant will be sending your password, basically, to the attacker using the mobile model that is included in the implant.”
Listen at 6:45
CryptoBillis’s founder sold the company roughly six months before the incident
“the founder of Cryptobilis had sold the company about six months prior”
Listen at 7:35
A Ledger Flex bought from Metapod contained a spy implant
“inside this device, there was also a spy implant”
Listen at 11:57
The implant uses chips to monitor the screen and transmit captured passphrases over mobile networks
“it's still the same kind of boards and the same process of having three chips, one which is monitoring the screen and taking note of the passphrase, one that is communicating with the mobile network to send what has been captured, and an eSIM”
Listen at 12:36
The attackers have substantially improved the implant through funded research and development
“whoever is doing this is learning and making improvements. And not just very small improvements, but very giant leaps doing real research with a lot of funding to create those boards.”
Listen at 13:55
The implant operation involved months of research and development
“They spent months of research and development building this.”
Listen at 15:02
Similar implants appeared among resellers outside Malaysia, including Singapore
“we are seeing the same kind of implants in other resellers outside of Malaysia, like in Singapore”
Listen at 16:01
A Ledger device sent to Mark contained a spy implant
“confirmed that it had a spy implant”
Listen at 19:34
Users can easily inspect a Ledger Nano X for compromise
“The fact is, as the end user, it's very easy to verify when you buy your Ledger, if it's compromised or not, especially if it's a Nano X, it can be opened easily.”
Listen at 21:40
The new implant enables mass production and is likely to spread further
“this new implant is made for mass production and the ease of installation. Let me say that we're likely going to see a lot more of it in the future.”
Listen at 24:13
Users can verify whether a Ledger device has been implanted before use
“the one thing that I can say for now that is easy to do is to verify if a device has been implanted or not when you're going to use it for yourself.”
Listen at 25:03
Ending Ledger’s authorized reseller program would be excessive
“I would say that's probably too drastic.”
Listen at 29:14
Ledger should advise reseller customers to inspect device internals against the manual
“Ledger could have maybe, what I would have seen a good idea, is to tell people that when buying a ledger from a sub-party, even an authorized reseller, to maybe have a look inside and verify that the hardware is as shown into the manual that Ledger provides.”
Listen at 30:14
Known implants must connect beneath the Ledger Nano X screen
“all the implants existing today will have to connect to the part right here”
Listen at 38:14
Statements are attributed to the speaker as said on the episode and reflect their view at the time, not PodLume's. They are not advice.
Weekly email
State of the Pod, every Monday
The week's most-discussed names and stories from podcasts, with the moments behind them. Free, five minutes, unsubscribe in one click.