Modified Ledger Wallets Have Exposed Recovery Phrases
Security experts warned that tampered hardware wallets can secretly transmit user data via hidden SIM cards.
Updated on Oct. 10, 2026 in Cybersecurity
Live Poll
Do you trust hardware wallets to securely store your digital recovery phrases?
Mark Karpelès issued a warning about altered Ledger hardware wallets that can compromise user security. The modified devices utilize hidden SIM cards to intercept and transmit recovery phrases to unauthorized parties.
Why it matters
This discovery highlights significant risks for users purchasing hardware wallets from secondary sources, as physical tampering can bypass standard security protocols. The ability for modified devices to remain functional while leaking sensitive information poses a threat to digital asset storage.
The tampered devices feature hidden SIM cards capable of transmitting recovery phrases displayed during wallet setup. Modified hardware remains capable of passing official authenticity checks if original security chips are left undisturbed.
The players
Mark Karpelès
He is a computer programmer and former CEO who frequently shares insights and alerts regarding digital security and cryptocurrency storage.
Ledger
The company is a manufacturer of popular hardware wallets designed to provide secure, offline storage for cryptocurrency and other digital assets.
The details
The physical implants are placed beneath the device screen to intercept data before it is rendered for the user. An examined unit discovered in Malaysia was found to have been resealed with original-looking shrink-wrap packaging, making physical detection nearly impossible for average consumers.
Timeline
October 8, 2026: Mark Karpelès issued the formal security warning regarding the altered devices.
The Tech Race
This vulnerability marks a departure from the security promises inherent to Ledger's native hardware security architecture. It reflects an ongoing escalation in the arms race between security hardware manufacturers and malicious actors targeting supply chains.
Users should exercise caution by only purchasing hardware wallets directly from verified official manufacturers or authorized retailers. Consumers who suspect their device may have been tampered with should immediately transfer assets to a new, confirmed authentic wallet.
The takeaway
Maintaining the integrity of physical security keys is essential for protecting crypto holdings against supply chain attacks. Consumers should avoid purchasing discounted hardware from unverified third-party vendors to ensure their recovery phrases remain private.
Further reading
For more information on protecting digital assets, see our Cybersecurity section.
Live Poll
Do you trust hardware wallets to securely store your digital recovery phrases?
