Ledger, Coldcard, Hardware Wallets, CryptoBilis And Threat Of Physical, Supply-Chain Attacks Analyzed In New Report
The discovery of a covert hardware implant inside a Ledger Nano X sold by an authorized reseller underscores that cryptocurrency security cannot stop at the protocol layer.
In early October 2026, users who purchased devices through Southeast Asian reseller CryptoBilis reported sudden fund losses.
Ledger confirmed that at least one affected signer contained an unauthorized implant.
Its Donjon security team later described the mechanism: the added circuitry sits inside the enclosure, monitors the screen, recognizes the 24-word recovery phrase displayed during setup, decodes the words, and transmits them over LTE via a provisioned eSIM.
The implant leaves the Secure Element and operating system untouched, so standard genuineness checks can still pass.
Ledger stated that all confirmed drains from the October 9 incident involved CryptoBilis devices and that its own manufacturing, systems, and direct sales channels showed no signs of compromise.
On-chain estimates from researchers put losses between roughly $86 million and more than $100 million across hundreds of wallets.
Separate user reports of similar implants in devices bought at European MediaMarkt stores prompted the retailer to pause sales, though Ledger has not verified drains outside the CryptoBilis channel.
Self-custody places private keys under the holder’s direct control, yet it also places full responsibility for device integrity, backups, and recovery on that same individual.
Exchange custody and crypto exchange-traded products shift those operational burdens to intermediaries, introducing counterparty, regulatory, and operational risks of their own.
Neither model eliminates exposure; each reallocates it.Blockchain analytics firms have repeatedly documented the practical costs of imperfect self-custody.
Chainalysis, TRM Labs, Elliptic, and CertiK routinely trace stolen funds from wallet compromises and highlight how physical or supply-chain vectors bypass cryptographic protections.
TRM Labs, for example, tracked the 2026 Coldcard incident in which a longstanding firmware flaw caused certain devices to generate seeds with far weaker entropy than intended.
Attackers brute-forced the predictable seeds and drained on the order of 1,800 BTC—roughly $100 million or more—from thousands of addresses without ever touching the hardware.
CertiK and Chainalysis have both mapped the rising volume of “wrench attacks,” in which assailants use violence or threats to coerce key disclosure.
Chainalysis estimated more than $30 million stolen this way in the first half of 2026, with home invasions rising sharply; CertiK verified dozens of incidents and far higher exposure figures, noting France as a particular hotspot.
Jameson Lopp’s long-running catalog of physical attacks now exceeds 360 cases, with frequency remaining elevated into 2026.
Hardware wallet makers have faced recurring non-cryptographic failures. Ledger’s 2020 e-commerce database breach exposed names, addresses, and phone numbers for hundreds of thousands of customers, fueling persistent phishing and raising concerns about targeted physical threats.
The company also dealt with a 2023 software-library compromise. Trezor has disclosed multiple customer-data exposures stemming from third-party shipping and support partners.
Coldcard’s entropy bug remained undetected in public code for years.
These episodes, alongside the current reseller implant case, illustrate that supply-chain, firmware, and human-coercion risks sit outside the secure element itself.
The latest incident reinforces a longstanding caution: purchasing only from the manufacturer or tightly controlled channels reduces, but does not erase, risk.
For high-value holdings, many practitioners continue to recommend verifying device internals, generating seeds only on trusted hardware, and treating recovery phrases as the single point of failure they remain. Custody choices ultimately trade one set of residual risks for another.
Notably, CoinShares has framed the recent reseller implant case as a reminder that custody is never binary.
In a public comment following the disclosure, the firm noted that the discovery places the full spectrum of custody risks back under scrutiny, because exchange custody, self-custody and crypto ETPs each allocate operational responsibility in different ways.
None of the models eliminates risk; each simply relocates it.
Their longer-standing analysis of the same trade-offs emphasises that self-custody demands technical skill, continuous vigilance over devices and backups, and accepts irreversible loss if a seed is compromised or lost.
Exchange custody, by contrast, concentrates counterparty and operational risk in a single platform, while regulated ETPs shift key management and physical security to specialised, supervised custodians and integrate exposure into traditional brokerage and portfolio structures.
The firm’s own physical crypto ETPs illustrate one institutional expression of that shift.
Underlying assets are held by regulated custodians such as Komainu—a joint venture originally formed with Nomura and Ledger—under frameworks designed for institutional standards, bankruptcy remoteness and independent oversight.
CoinShares has long argued that this model suits longer-term investors who prefer not to bear the full weight of device provenance, seed protection and recovery themselves, while still retaining the ability, under certain conditions, to redeem for the underlying asset.
The latest supply-chain episode, layered on earlier firmware and data-leak incidents affecting major hardware wallet makers, simply reinforces the point they have made for years: the choice among custody paths is ultimately a choice about which residual risks an investor is willing and equipped to manage.
