Security researcher Taylor Monahan says scammers turned fear from a reseller supply-chain incident into a recovery-phrase phishing campaign
The scariest part of the recent Ledger saga may not be the hardware at all. According to security expert Taylor Monahan, most of the fresh loss reports trace back to people who panicked and handed their recovery phrases to scammers.
Speaking on the Unchained podcast, Monahan argued that the wave of reported losses reflects fear-driven fraud rather than widespread device tampering.
Monahan’s argument is simple. Scammers saw a real security scare unfold and used the resulting anxiety as bait.
Worried owners were steered toward fraudulent websites and apps. There, they typed in their 24-word recovery phrases, believing they were protecting their funds.
A recovery phrase is the master key to a crypto wallet. Anyone holding those 24 words can rebuild the wallet on any device and drain it, no hardware required.
Loss figures tied to the broader episode are estimated at between $70 million and $100 million, accumulated over several months. On-chain figures cluster in a tighter band, around $86 million to $93 million.
The panic did not come from nowhere. It grew out of a genuine supply-chain problem involving a limited number of Ledger devices.
Those units were sold through CryptoBilis, an authorized Ledger reseller. They were found to contain unauthorized hardware implants capable of capturing recovery phrases while the owner set up the device.
Daily. Free. Join 34,000+ readers across crypto, finance, and policy.
The implants could grab recovery phrases during setup without altering the Secure Element, the chip that stores and protects private keys inside the device. Because the Secure Element was untouched, the implants could bypass the device’s authenticity checks.
Ledger has confirmed the implants were found only in devices bought from CryptoBilis. The company also said that every verified case of lost user funds traces back to that single reseller.
The company has issued a few blunt instructions. The first is one it has repeated for years: Ledger will never ask users for their recovery phrase.
Ledger has also advised against using affected devices purchased within the last 90 days. Anyone who bought a unit from the affected reseller has been urged not to activate it.
Owners in that position have been encouraged to consider moving funds to a new, untainted wallet. The logic is straightforward: if the phrase may have been seen, the wallet should be treated as compromised.
Monahan’s framing flips the usual narrative about hardware wallet risk. The confirmed tampering was narrow, tied to one reseller and a limited batch of devices.
The scams that followed were not so narrow. They could reach any Ledger owner who read a scary headline and went searching for a fix.
Scammers do not need to break a Secure Element if they can persuade someone to recite the keys. Social engineering scales in a way hardware implants simply cannot.
For individual holders, the practical lesson is clear. Where you buy a hardware wallet matters, and so does what you do when something feels urgent.
Ledger has pointed to its direct sales as unaffected, and the confirmed implants were limited to CryptoBilis units.
A recovery phrase should never be typed into a website, an app, or a form, no matter how official it looks or how alarming the warning seems.