Ledger confirms hidden spy chip in hardware wallets sold by Malaysian reseller behind crypto thefts

TLDR

• Ledger confirmed at least one wallet sold through reseller CryptoBilis held a hidden implant that captured users' seed phrases.¹²
• Tampered units are now reported from other sellers, so the whole sales channel, not one retailer, is the risk.⁴⁵
• Ledger says it cannot verify the estimated $86 million to $87 million in suspected losses.³⁶

Update, 15 October, what changed: the problem is no longer confined to CryptoBilis. Ledger has asked all resellers and distributors in Southeast Asia (Indonesia, Singapore, Thailand, the Philippines, Vietnam and Malaysia) and Hong Kong to halt wallet sales and pull stock until its investigation into device safety is complete.⁴⁵ Users have reported tampered devices bought from other sellers: a Metapod retailer at Singapore's Changi Airport, and, reportedly, a Challenger outlet at VivoCity.⁴⁵ In Europe, MediaMarktSaturn pulled Ledger products from stores and online across its 11 markets after a customer in Germany reported an implant; Ledger said no funds were lost in that case.⁵⁶ Ledger has not confirmed that the Singapore airport device is linked to the CryptoBilis incident.⁶

Ledger's Donjon security team said the implant's microcontroller detects and decodes the 24-word recovery phrase and sends it over LTE using a provisioned eSIM, and that it is a separate component that does not modify the Secure Element or Ledger operating system, which is why the device's integrity self-checks cannot see it.⁴⁶ Ledger says all confirmed fund losses involve CryptoBilis devices and that it cannot verify the roughly $86 million estimated by blockchain analysts, or the number of users affected.⁵⁶ Rival vendors are tightening their channels: Trezor, which says it has found no evidence its devices were compromised, will end authorisation for a group of resellers on 1 January 2027, and OneKey has revoked CryptoBilis' authorisation and is offering free replacements for devices bought through it between 1 March and 13 October.⁴⁶

Ledger has confirmed that hardware wallets sold through CryptoBilis, a reseller operating in Southeast Asia, were physically tampered with to contain a concealed spy chip capable of stealing users' cryptocurrency.¹ The implant, found in Ledger Nano X units according to researcher reporting, captures the device's display output and button presses to identify the owner's seed phrase and transmits it to the attacker over a hidden LTE module paired with a tiny eSIM.¹ Researchers who examined the tampered devices, including former Mt. Gox CEO Mark Karpelès and the crypto research studio Tibane Labs, described the implants as using professionally manufactured flex circuit boards rather than hand-soldered modifications, with component markings scraped off to hide their origin.¹

Ledger said it is "reaching out to impacted users as part of the ongoing investigation" and is working with authorities to identify the perpetrator, while advising anyone who bought a device from CryptoBilis and has not yet set it up to avoid doing so.¹ Customers who have already configured a CryptoBilis-sourced device are being told to move their assets to a new Ledger signer with a freshly generated seed.¹ CoinDesk reported Ledger has confirmed at least one case directly, while Decrypt reported that every confirmed draining case the company has traced so far ties back to CryptoBilis-sold devices, with suspected total losses across affected users estimated at around $87 million.²³ Ledger has not disclosed how many devices were affected but described the scale as "limited."¹

Why it matters: a seed phrase never has to leave a hardware wallet to be stolen if the wallet itself is compromised before it reaches the buyer, and with tampered units now reported beyond the original reseller, the sales channel, not just one retailer, has to be treated as the risk, even though Ledger says its direct sales channel and infrastructure are unaffected.⁴