Unchained
Unchained
Laura Shin
Ledger Wallets Were Drained of $100 Million. Is Self-Custody Still Safe?
44 minutes Posted Oct 16, 2026 at 7:00 pm.
Intro
How Jonty spotted the Ledger drains through SEAL 911 victim reports
How the implant reads a 24-word seed phrase and sends it out by eSIM
Mark on the spy implant he found in a Ledger Flex bought in Singapore
CryptoBilis or a distributor? Mark and Jonty on who could be behind it
Nexo: Generate daily interest on your crypto or borrow against your assets at https://unchainedcrypto.com/go/nexo-podcast-yt
MediaMarkt and Aqipa: has the Ledger implant reached Europe?
Buying direct vs. through a reseller, and why Vietnam needs resellers
Ledger's 'tamper-proof' notice and whether self-custody is dead
Mark opens a Nano X on camera to show how to check for an implant
Tether's $10M freeze and why Jonty says recovery could take years
0:00
44:36
Download MP3
Show notes
A hidden implant read Ledger seed phrases off the screen and sent them out over an eSIM. Mark Karpelès and SEAL 911's Jonty discuss what that means for self-custody.
========================================================
Thank you to our sponsor!
Put your crypto to work with Nexo: earn daily interest or borrow funds against your assets on one platform trusted by more than 10 million clients.
Find out more at ⁠https://unchainedcrypto.com/go/nexo-podcast-sn⁠.
Geo-restrictions, eligibility and terms apply.
========================================================
Quick favor: We're deciding what Unchained does next; new shows, stream times, what's worth paying for.⁠⁠⁠⁠⁠⁠⁠ Our listener survey⁠⁠⁠⁠⁠⁠⁠ takes five minutes, it's anonymous, and I read the write-in answers myself. Everyone who takes it can enter a drawing for a free year of Unchained Premium or Bits + Bips Premium. Open through Sunday, October 18.
— Laura
========================================================
An estimated $100 million or more has been drained from Ledger hardware wallets sold through CryptoBilis, an authorized reseller in Southeast Asia. The devices carried a hidden implant that reads the seed phrase off the screen and sends it out over an eSIM.
Jonty, founder of Pangolin Intelligence and a SEAL 911 contributor, and Mark Karpelès, CEO of Karpelès Lab, join Laura Shin to trace how the attack was found and how far it may reach.
They cover drains dating back to September 8, a tampered Ledger Flex bought from Metapod at Singapore's airport, the two MediaMarkt devices a buyer in Europe traced to distributor Aqipa, and Tether's $10 million freeze.
Mark argues Ledger's manual sends mixed signals by picturing the device's insides while warning that opening it voids the warranty, then opens a Nano X on camera to show what to look for.
The open question is whether self-custody's best defense against malware has become its newest attack surface.
Host:
⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Laura Shin⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, Host / Unchained
Guests:
⁠⁠⁠⁠⁠⁠⁠⁠⁠Mark Karpelès - CEO of Karpelès Lab Inc.
⁠⁠⁠⁠⁠⁠⁠⁠⁠Jonty - Founder of Pangolin Intelligence and Contributor to SEAL 911
Timestamps
🎬
🚨
📡
🛫
🕵️
📣
🇪🇺
🛒
🔐
🔧
🧊
Learn more about your ad choices. Visit megaphone.fm/adchoices