Ledger Wallets Were Drained of $100 Million. Is Self-Custody Still Safe?
Unchained | Oct 16 2026 | 00:44:36
A hidden implant read Ledger seed phrases off the screen and sent them out over an eSIM. Mark Karpelès and SEAL 911's Jonty discuss what that means for self-custody.
========================================================
Thank you to our sponsor!
Put your crypto to work with Nexo: earn daily interest or borrow funds against your assets on one platform trusted by more than 10 million clients.
Find out more at https://unchainedcrypto.com/go/nexo-podcast-sn.
Geo-restrictions, eligibility and terms apply.
========================================================
Quick favor: We're deciding what Unchained does next; new shows, stream times, what's worth paying for. Our listener survey takes five minutes, it's anonymous, and I read the write-in answers myself. Everyone who takes it can enter a drawing for a free year of Unchained Premium or Bits + Bips Premium. Open through Sunday, October 18.
— Laura
========================================================
An estimated $100 million or more has been drained from Ledger hardware wallets sold through CryptoBilis, an authorized reseller in Southeast Asia. The devices carried a hidden implant that reads the seed phrase off the screen and sends it out over an eSIM.
Jonty, founder of Pangolin Intelligence and a SEAL 911 contributor, and Mark Karpelès, CEO of Karpelès Lab, join Laura Shin to trace how the attack was found and how far it may reach.
They cover drains dating back to September 8, a tampered Ledger Flex bought from Metapod at Singapore's airport, the two MediaMarkt devices a buyer in Europe traced to distributor Aqipa, and Tether's $10 million freeze.
Mark argues Ledger's manual sends mixed signals by picturing the device's insides while warning that opening it voids the warranty, then opens a Nano X on camera to show what to look for.
The open question is whether self-custody's best defense against malware has become its newest attack surface.
Host:
Laura Shin, Host / Unchained
Guests:
Mark Karpelès - CEO of Karpelès Lab Inc.
Jonty - Founder of Pangolin Intelligence and Contributor to SEAL 911
Timestamps
🎬 00:00 Intro
🚨 03:50 How Jonty spotted the Ledger drains through SEAL 911 victim reports
📡 05:52 How the implant reads a 24-word seed phrase and sends it out by eSIM
🛫 11:33 Mark on the spy implant he found in a Ledger Flex bought in Singapore
🕵️ 15:16 CryptoBilis or a distributor? Mark and Jonty on who could be behind it
📣 17:38 Nexo: Generate daily interest on your crypto or borrow against your assets at https://unchainedcrypto.com/go/nexo-podcast-yt
🇪🇺 18:19 MediaMarkt and Aqipa: has the Ledger implant reached Europe?
🛒 27:00 Buying direct vs. through a reseller, and why Vietnam needs resellers
🔐 31:30 Ledger's 'tamper-proof' notice and whether self-custody is dead
🔧 36:45 Mark opens a Nano X on camera to show how to check for an implant
🧊 40:33 Tether's $10M freeze and why Jonty says recovery could take years
Learn more about your ad choices. Visit megaphone.fm/adchoices
========================================================
Thank you to our sponsor!
Put your crypto to work with Nexo: earn daily interest or borrow funds against your assets on one platform trusted by more than 10 million clients.
Find out more at https://unchainedcrypto.com/go/nexo-podcast-sn.
Geo-restrictions, eligibility and terms apply.
========================================================
Quick favor: We're deciding what Unchained does next; new shows, stream times, what's worth paying for. Our listener survey takes five minutes, it's anonymous, and I read the write-in answers myself. Everyone who takes it can enter a drawing for a free year of Unchained Premium or Bits + Bips Premium. Open through Sunday, October 18.
— Laura
========================================================
An estimated $100 million or more has been drained from Ledger hardware wallets sold through CryptoBilis, an authorized reseller in Southeast Asia. The devices carried a hidden implant that reads the seed phrase off the screen and sends it out over an eSIM.
Jonty, founder of Pangolin Intelligence and a SEAL 911 contributor, and Mark Karpelès, CEO of Karpelès Lab, join Laura Shin to trace how the attack was found and how far it may reach.
They cover drains dating back to September 8, a tampered Ledger Flex bought from Metapod at Singapore's airport, the two MediaMarkt devices a buyer in Europe traced to distributor Aqipa, and Tether's $10 million freeze.
Mark argues Ledger's manual sends mixed signals by picturing the device's insides while warning that opening it voids the warranty, then opens a Nano X on camera to show what to look for.
The open question is whether self-custody's best defense against malware has become its newest attack surface.
Host:
Laura Shin, Host / Unchained
Guests:
Mark Karpelès - CEO of Karpelès Lab Inc.
Jonty - Founder of Pangolin Intelligence and Contributor to SEAL 911
Timestamps
🎬 00:00 Intro
🚨 03:50 How Jonty spotted the Ledger drains through SEAL 911 victim reports
📡 05:52 How the implant reads a 24-word seed phrase and sends it out by eSIM
🛫 11:33 Mark on the spy implant he found in a Ledger Flex bought in Singapore
🕵️ 15:16 CryptoBilis or a distributor? Mark and Jonty on who could be behind it
📣 17:38 Nexo: Generate daily interest on your crypto or borrow against your assets at https://unchainedcrypto.com/go/nexo-podcast-yt
🇪🇺 18:19 MediaMarkt and Aqipa: has the Ledger implant reached Europe?
🛒 27:00 Buying direct vs. through a reseller, and why Vietnam needs resellers
🔐 31:30 Ledger's 'tamper-proof' notice and whether self-custody is dead
🔧 36:45 Mark opens a Nano X on camera to show how to check for an implant
🧊 40:33 Tether's $10M freeze and why Jonty says recovery could take years
Learn more about your ad choices. Visit megaphone.fm/adchoices