Ledger Wallets Were Drained of $100 Million. Is Self-Custody Still Safe?
Ledger Wallets Were Drained of $100 Million. Is Self-Custody Still Safe?
2 hours ago•Unchained•Laura Shin
Podcast44 min 36 sec
Listen to Episode
Note: AI-generated summary based on third-party content. Not financial advice. Read more.
Quick Insights

For self-custody, use a hardware wallet rather than a hot wallet, but buy directly from the manufacturer when practical and follow its current security guidance. Treat any device that appears tampered with as unsafe; move funds to a fresh wallet carefully, without rushing. The discussion provided no actionable price targets or high-conviction investment recommendations for ETH, crypto ETFs, Ledger, or Nexo.

Detailed Analysis

Crypto and Self-Custody

  • Guests said hardware wallets reduce risks from malware on internet-connected computers and phones, and are still likely the best option for retail users who want to hold their own crypto.
  • The discussion highlighted a serious supply-chain risk: tampered Ledger devices bought through resellers in Southeast Asia were linked to more than $100 million in reported thefts. The implant could capture a device’s 24-word recovery phrase during setup and send it to attackers.
  • The guests said the implants had become easier to install and suitable for mass production, raising concern that similar attacks could become more common.
  • They also emphasized that hot wallets can face greater malware-related losses, while self-custody carries its own risks. Panic-driven attempts to open a device or move funds can cause users to lose access to their crypto.
  • Buying directly from the manufacturer can reduce the number of intermediaries in the supply chain, though some users rely on authorized resellers for privacy or because of local import rules.

Takeaways

  • If choosing self-custody, the guests favored hardware wallets over hot wallets for most retail users, but stressed that hardware wallets are not risk-free.
  • Consider buying directly from the manufacturer when practical. If using a reseller, verify the device carefully and follow current guidance from the manufacturer.
  • If a device appears compromised, treat it as unsafe and carefully move assets to a fresh, secure wallet. Avoid rushing; the guests warned that mistakes during an urgent transfer can create additional losses.
  • The discussion does not establish that all Ledger devices, or devices sold outside Southeast Asia, are compromised. Ledger said its own checks of European store and warehouse samples found no evidence of tampering; the guests noted that they could not independently confirm thefts from European purchases.

Ledger (Hardware Wallets)

  • The episode focused on Ledger devices, including reports of compromised Nano X and Ledger Flex wallets. Researchers described implants that could read the recovery phrase during setup.
  • Ledger said the reseller issue it had confirmed involved Southeast Asia. It reported finding no compromised units in samples it examined from Germany, stores, and warehouses, despite reports from a user who said they found implants in devices bought in Europe.
  • Ledger asked CryptoBillis to pause sales and shipments. Guests said authorized resellers can serve legitimate needs, but the incident raised questions about oversight, supply-chain controls, and whether devices should be easier to inspect.
  • In a post-show announcement, Ledger introduced the Ledger Atom, marketed with a secure element, a privacy switch, quantum-readiness features, AI-agent features, and DeFi access. The announcement received negative reactions online because of its timing after the security incident.

Takeaways

  • Treat the Ledger incident as a significant product and supply-chain concern, but not as evidence that every Ledger device is compromised.
  • The episode offered no stock ticker, valuation, or explicit recommendation to invest in Ledger. The discussion was about product security and customer trust, not the company’s shares.
  • The Atom’s features and reception were mentioned, but the transcript provided no evidence about its security performance or commercial prospects.

Ethereum (ETH)

  • The guests said 464 ETH from the thefts had passed through Tornado Cash.
  • They described asset recovery as difficult because funds were commingled and victims were spread across multiple jurisdictions. Recovery could take months or years, and the outcome was uncertain.

Takeaways

  • ETH was discussed as part of tracing stolen funds, not as an investment recommendation. The episode gave no price target, forecast, or directional view on ETH.

Tether Stablecoin (Transcript: “USCT”; likely USDT)

  • The host said Tether had frozen about $10 million in a stablecoin transcribed in the episode as “USCT.” The guests said the rapid reporting and coordination helped enable the freeze.
  • They noted that freezing assets is not the same as returning them to victims; legal and law-enforcement processes across jurisdictions could make recovery slow and complex.

Takeaways

  • The discussion highlighted that some centralized stablecoin issuers may be able to freeze tokens, but it did not establish that frozen funds will be returned or when.
  • No investment recommendation or price outlook for the stablecoin was provided.

Nexo

  • A sponsor described Nexo as a digital-asset platform offering daily interest on crypto and loans secured by crypto. The ad said eligibility, geographic restrictions, and terms apply.
  • The episode did not provide interest rates, loan terms, or an independent assessment of the service.

Takeaways

  • Treat this as a promotional mention rather than an endorsed investment opportunity. Review the platform’s current terms, eligibility, and risks before considering a crypto deposit or loan.

Crypto ETFs and Exchange Custody

  • A guest noted that people who want exposure to mainstream cryptocurrencies can consider ETFs or entrust assets to an exchange rather than self-custody. These were presented as alternatives, not recommendations for a specific product or provider.

Takeaways

  • The discussion framed custody as a trade-off: self-custody gives users direct control but requires careful security practices, while third-party custody avoids managing wallet devices but depends on the provider.
  • No ETF, exchange, ticker, fee comparison, or specific recommendation was given.
Ask about this postAnswers are grounded in this post's content.
Episode Description
A hidden implant read Ledger seed phrases off the screen and sent them out over an eSIM. Mark Karpelès and SEAL 911's Jonty discuss what that means for self-custody. ======================================================== Thank you to our sponsor! Put your crypto to work with Nexo: earn daily interest or borrow funds against your assets on one platform trusted by more than 10 million clients. Find out more at ⁠https://unchainedcrypto.com/go/nexo-podcast-sn⁠. Geo-restrictions, eligibility and terms apply. ======================================================== Quick favor: We're deciding what Unchained does next; new shows, stream times, what's worth paying for.⁠⁠⁠⁠⁠⁠⁠ Our listener survey⁠⁠⁠⁠⁠⁠⁠ takes five minutes, it's anonymous, and I read the write-in answers myself. Everyone who takes it can enter a drawing for a free year of Unchained Premium or Bits + Bips Premium. Open through Sunday, October 18. — Laura ======================================================== An estimated $100 million or more has been drained from Ledger hardware wallets sold through CryptoBilis, an authorized reseller in Southeast Asia. The devices carried a hidden implant that reads the seed phrase off the screen and sends it out over an eSIM. Jonty, founder of Pangolin Intelligence and a SEAL 911 contributor, and Mark Karpelès, CEO of Karpelès Lab, join Laura Shin to trace how the attack was found and how far it may reach. They cover drains dating back to September 8, a tampered Ledger Flex bought from Metapod at Singapore's airport, the two MediaMarkt devices a buyer in Europe traced to distributor Aqipa, and Tether's $10 million freeze. Mark argues Ledger's manual sends mixed signals by picturing the device's insides while warning that opening it voids the warranty, then opens a Nano X on camera to show what to look for. The open question is whether self-custody's best defense against malware has become its newest attack surface. Host: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Laura Shin⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, Host / Unchained Guests: ⁠⁠⁠⁠⁠⁠⁠⁠⁠Mark Karpelès - CEO of Karpelès Lab Inc. ⁠⁠⁠⁠⁠⁠⁠⁠⁠Jonty - Founder of Pangolin Intelligence and Contributor to SEAL 911 Timestamps 🎬 00:00 Intro 🚨 03:50 How Jonty spotted the Ledger drains through SEAL 911 victim reports 📡 05:52 How the implant reads a 24-word seed phrase and sends it out by eSIM 🛫 11:33 Mark on the spy implant he found in a Ledger Flex bought in Singapore 🕵️ 15:16 CryptoBilis or a distributor? Mark and Jonty on who could be behind it 📣 17:38 Nexo: Generate daily interest on your crypto or borrow against your assets at https://unchainedcrypto.com/go/nexo-podcast-yt 🇪🇺 18:19 MediaMarkt and Aqipa: has the Ledger implant reached Europe? 🛒 27:00 Buying direct vs. through a reseller, and why Vietnam needs resellers 🔐 31:30 Ledger's 'tamper-proof' notice and whether self-custody is dead 🔧 36:45 Mark opens a Nano X on camera to show how to check for an implant 🧊 40:33 Tether's $10M freeze and why Jonty says recovery could take years Learn more about your ad choices. Visit megaphone.fm/adchoices
About Unchained
Unchained

Unchained

By Laura Shin

Crypto assets and blockchain technology are about to transform every trust-based interaction of our lives, from financial services to identity to the Internet of Things. In this podcast, host Laura Shin, an independent journalist covering all things crypto, talks with industry pioneers about how crypto assets and blockchains will change the way we earn, spend and invest our money. Tune in to find out how Web 3.0, the decentralized web, will revolutionize our world. Disclosure: I'm a nocoiner.