Something fascinating is quietly playing out in the cryptocurrency world, where super-secure hardware wallets are being physically hacked in order to steal secret keys and empty victims’ accounts. Security researchers, led by Joe Grand, have discovered multiple generations of hardware circuitry added to Ledger Nano, Flex, and Stax hardware wallets that hijack secret keys, then send them via SIM cards to the hackers.
This is not a software hack. This is a direct compromise of the hardware within a device, and somehow it is being done within the supply chain, likely after manufacturing but before they get into the hands of consumers. They are showing up in new devices being sold from authorized vendors.
Hardware wallets are considered the gold standard in security when it comes to protecting digital assets. In most cases, they are securely designed to be highly resistant to software attacks and pose considerable challenges to social engineering tactics. The key to their defense is that, in practical terms, the hardware within the device itself would need to be modified.
That is exactly what is happening.
Attackers are opening the device and soldering on flexible circuit boards to the main components, including an eSIM, antenna, and LTE module, to exfiltrate harvested data. Attackers replace the battery with a smaller version to get space to work with and modify a number of embedded systems. The unwanted implant steals secret recovery seeds of wallets, which enables the attackers to take control of assets directly on the global blockchains.
Image Source: Joe Grand’s presentation at Tropicon conference showing a Ledger Nano X device with a custom-built flexible circuit implant (the transparent layer) and a smaller replacement battery connected to the legitimate board.
Over a hundred million dollars have already been stolen, and nobody knows the extent of these hacks. They do know that one of the authorized vendors is in Asia, but there are concerns that others may be affected. Somewhere in the supply chain, attackers are cracking open new hardware wallets, soldering in sophisticated components, and repackaging them as new.
The only way to detect such hardware attacks is to open the case and take a careful look for the unauthorized components. This is no easy task, as attackers have evolved to make them appear legitimate.
Joe Grand presentation at Tropicon 2026 showcases his process and findings
The strategic consideration is that hardware hacking is absolutely real. If consumer wallets are being targeted, we must consider that broader attacks against networking equipment, cellular technologies, pre-built servers, and other infrastructure devices are very likely. The cybersecurity industry has been warning of such hacks for years but often disregarded as fear-mongering.
If we continue down this rabbit hole, we should advance discussions about the hardware hacking of medical devices, industrial systems for monitoring and control of critical infrastructure systems, transportation devices in the automotive and airline industries, defense industry components, and scientific research equipment. Hardware-level espionage and cybercrime are a growing reality that increases the risks to everyone.
