🔐 A “secure” wallet that sends your 24 words to a thief over a mobile network? That’s what Ledger confirmed on October 13.
Mariam, in Conakry, wants to buy a hardware wallet to keep her savings in $USDT. The cheapest one is from an online reseller. Her question: “Isn’t it the same device everywhere?”
📌 The facts
• Ledgers sold by CryptoBilis, a reseller listed as authorized in Indonesia, Malaysia, and the Philippines, contained a hidden spy chip.
• During setup, the chip reads the 24 words displayed on the screen and sends them via an eSIM (4G network).
• Losses estimated by on-chain investigators: $86–93M, across more than 300 wallets. Ledger has not verified these figures.
• Tether froze around 10 M$ USDT. MediaMarkt suspended Ledger sales in Europe after a case was reported in Germany.
🧠 How it works
The 24 words (recovery phrase) are the master key: anyone who has them can empty the wallet from any device. Ledger’s secure chip was not hacked. The attack happens BEFORE that, along the route from the factory to you.
⚖️ The nuance
This is not a software vulnerability. The sales chain failed. Trezor and OneKey cut ties with this reseller as a precaution.
👉 Mariam’s checklist
1. Prefer to buy from the brand’s official website (even an “authorized” reseller can fail).
2. Reject any device that has already been opened or comes with words already printed.
3. Never photograph or type your 24 words on a phone.
4. In doubt about a device? Set up a new wallet on a trusted device, then transfer the funds.
Same lesson for a simple wallet on your phone: your 12 or 24 words are your money.
Where do you buy your crypto hardware? 👇
Not financial advice. DYOR.
Sources: Ledger (X), The Block, CoinDesk, Bitquery (Oct. 13, 2026).
#Ledger #Sécurité #CryptoAfrique #Scam