Hundreds of explosions that erupted from handheld pagers across Beirut may have been the result of booby-trapped devices rather than a cyber attack, security experts have suggested.
The pagers, which were being used by Hezbollah officials to communicate privately, detonated across the Lebanese capital on Tuesday, reportedly injuring thousands of people, including civilians and militant fighters.
Nobody has claimed responsibility for the explosions, but the dramatic attack triggered an obvious question: how did they do it?
One theory is the explosions were the result of an unprecedented cyber attack, with hackers somehow overheating and destroying the pagers remotely.
Another is supply chain sabotage, with Israel able to booby trap hundreds of pagers destined for use by Hezbollah.
A cyber attack could have involved manipulating these devices and causing their batteries to overheat. Lithium batteries will smoke or melt if overheated and can catch on fire, with past fires reported on gadgets including smartphones, e-bikes or scooters.
However, cyber security and military experts said such an attack would be unlikely to cause the kinds of sudden explosions seen in footage across social media.
Alan Woodward, a cyber security expert at the University of Surrey, said: “I’ve heard of lithium ion batteries spontaneously igniting but to make it happen on demand is a different matter entirely.”
He said these kinds of batteries seemed to catch fire rather than “explode,” which contrasted with the social media footage.
A more likely cause was sabotage using an “old-fashioned booby trap”, he said.
He said it could have been an “supply chain attack” where the Israeli Defence Force “hid a little C4 (a type of explosive) inside and set it to trigger upon receipt of a particular message or even just timed using device timer”.
The impacted devices appeared to include “rugged” pagers developed by Taiwanese company Gold Apollo, according to reporters at the website Bellingcat.
The pagers – small wireless communications devices designed to send short text messages –had been new models brought by officials at Hezbollah in recent months, multiple security sources also told Reuters.
Tony Ingesson, a former bomb disposal expert with the Swedish armed forces and an assistant professor at Lund University, also supported the explosion theory.
“The footage I have seen indicates an explosive substance of some sort. A very small charge is enough to injure someone. You don’t need much. The advantage here is it is a device people will carry on their person,” he said.
Ken Munro, founder of cyber security company Pen Test Partners, said: “I’m leaning hard toward a supply chain attack, as to remotely cause a battery to explode in such a fashion would be extremely challenging.”
Footage on social media showed dozens of individuals being treated for injuries in the wake of the blasts, which occurred around 3.45pm local time, with wounds to their hands, fingers or torso.
A former British army munitions officer told the BBC the devices could have been packed with as little as 10 to 20 grams of high explosive hidden inside fake electrical parts.
The former officer, who asked not to be named, said such a package could have been armed by a signal, with the next person to use the device triggering an explosion.
Bogdan Botezatu, head of threat research at cyber security company Bitdefender, said on X: “Hacked pagers and phones don’t randomly explode unless they are already attached to a nice ball of Semtex.
“Worst case, (lithium ion) batteries first catch on fire, then they go kaboom.”
The attack threatens to escalate simmering tensions across the Lebanese border, with Israel and Hezbollah engaging in repeated strikes since Oct 7 last year.
A statement by the Iran-backed group said Israel would get “fair punishment”.
Hezbollah had been known to use pagers as a low-tech solution to avoid Israeli signals intelligence. Hassan Nasrallah, the Hezbollah leader, had previously urged fighters not to carry mobile phones, warning they were “deadly agents”.
He has previously said that smartphones were “surveillance devices in your pockets. If you are looking for the Israeli agent, look at the phone in your hands”.
The Wall Street journal reported that medical staff across Lebanon were discarding their own pagers, which are routinely used in hospitals around the world to send rapid text messages to colleagues.
Lebanon’s state-run National News Agency blamed the attack on the “handheld pagers system [which] was detonated using advanced technology”.
Hezbollah officials, meanwhile, said the attack represented the group’s “biggest security breach” since Oct 7 last year.