Ledger Confirms Spy-Chip Hardware Implant Behind $93M+ Wallet Thefts

Ledger Confirms Hardware Implant Drained Wallets Sold Through Southeast Asian Reseller

Ledger has confirmed that hardware wallets distributed through the Southeast Asian reseller CryptoBilis were tampered with at the supply-chain level, fitted with a hidden hardware implant that captured users' 24-word recovery seed phrases and transmitted them to attackers over a cellular connection. The confirmation, issued October 10, 2026, followed a wave of reported crypto thefts that began October 9, 2026 and has since been linked by on-chain investigators to losses estimated between $86 million and over $93 million across 300+ wallets on Bitcoin, Ethereum, Tron, BNB Chain, and Polygon. Victims have been concentrated in Indonesia, Malaysia, and the Philippines, with reports also surfacing from devices resold on Amazon Japan and Yahoo! Auctions Japan.

The implant was first documented by former Mt. Gox CEO Mark Karpelès, who disassembled a Ledger device he had purchased in Malaysia and found suspicious electronics hidden behind the screen. Technical analysis firm Tibane Labs followed with a teardown confirming a microcontroller, cellular hardware, and connections tapped directly into the display's internal data lines — a design that lets the implant read exactly what the victim sees on screen during setup, including the recovery phrase, without ever touching Ledger's tamper-resistant Secure Element.

Incident Details

Attribute	Value
Vendor	Ledger (hardware crypto wallets)
Compromised channel	Reseller CryptoBilis (Malaysia-based, Southeast Asia distribution)
Affected model(s)	Ledger Nano X (confirmed); other models under review
Attack type	Hardware supply-chain implant (parasitic eavesdropping chip)
Disclosure date	October 9–10, 2026
Estimated losses	$86M–$93M+ (on-chain estimates vary; one tracker puts it as high as $103.4M)
Wallets/addresses affected	300+ (Bitquery puts it at 311 addresses; other trackers report up to 530)
Blockchains affected	Bitcoin, Ethereum, Tron, BNB Chain, Polygon
Regions affected	Indonesia, Malaysia, Philippines; devices also surfaced on Amazon Japan, Yahoo! Auctions Japan
Discovered by	Mark Karpelès (independent researcher), Tibane Labs (technical analysis), Bitquery (on-chain tracing)

How It Worked

Tampering at the reseller stage

Devices purchased through CryptoBilis — often at close to half the normal retail price — arrived in packaging that appeared factory-sealed and intact. Investigators believe the implants were installed somewhere in the distribution chain before devices reached CryptoBilis's shelves, rather than during Ledger's own manufacturing or fulfillment. On-chain data from Bitquery shows over 80% of drained wallets first received funds in June 2026 or later, suggesting the tampering campaign — and the window during which victims unknowingly set up compromised devices — had been running for months before the October thefts became visible.

Two implant variants

Researchers identified at least two distinct hardware revisions:

Variant one: Built around an ST STM32G431KBU6 microcontroller (ARM Cortex-M4), a roughly 2x2mm eSIM, and a compact LTE module. This version replaced the device's original battery with a smaller unit sized to power both the phone's wallet electronics and the implant.
Variant two (more advanced): Ran on the device's unmodified original battery and was fitted inside the foam padding beneath the OLED display using a custom-designed flex PCB — a level of fit-and-finish that points to organized, well-resourced manufacturing rather than ad hoc tampering.

Reading the screen, not breaking the chip

Rather than attempting to extract keys from Ledger's Secure Element — the tamper-resistant chip the device's entire security model is built around — the implant instead monitored the OLED display's data lines and button-press signals. During initial device setup, when the 24-word recovery seed is displayed on screen for the user to write down, the implant captured those words directly off the display feed and transmitted them to attacker-controlled infrastructure over an LTE connection using the embedded eSIM. Because the Secure Element itself was never touched or modified, Ledger's built-in Genuine Check authenticity verification — which attests to the integrity of the Secure Element — could not detect the added hardware. Attackers who received a seed phrase this way could reconstruct the wallet on any device and drain it independently, with no further interaction with the original compromised hardware required.

The theft wave

Losses became visible starting October 9, when researcher SpecterAnalyst first flagged a cluster of unexpected wallet drains on X. Bitquery's on-chain analysis subsequently traced roughly $70.5 million in Tron-based USDT transfers and $16.8 million in Bitcoin to the campaign, with one victim in Malaysia alone reporting a $3 million loss. Exchanges and chain-analysis firms managed to freeze approximately $10 million in USDT tied to attacker addresses before it could be laundered further.

Impact Assessment

Impact Area	Description
Financial	$86M–$93M+ in confirmed/estimated losses across 300+ wallets; some trackers estimate total exposure above $100M
Consumer trust	Undermines a core selling point of hardware wallets — that private keys and seed phrases never touch a network-connected device
Supply chain integrity	Demonstrates that even a security-hardened Secure Element cannot protect against physically parasitic implants added downstream of manufacturing
Detection gap	Ledger's Genuine Check cannot flag implants that don't modify the Secure Element itself, leaving a verification blind spot
Reputational	CryptoBilis has suspended all hardware wallet sales; Ledger has stated its own direct sales channels and infrastructure were not compromised
Secondary risk	Scammers have begun impersonating Ledger support to target anxious customers in the wake of the disclosure

Recommendations

For anyone who purchased a Ledger device through CryptoBilis (or an unverified third-party reseller)

Do not initialize or set up any unused device purchased through CryptoBilis. If a seed phrase was already generated on such a device, treat it as compromised.
Move all funds immediately to a brand-new wallet generated on a device purchased directly from Ledger.com or an official, verified retailer — do not reuse the old seed phrase under any circumstances.
Physically inspect any Ledger device purchased from a discount or unofficial reseller for signs of tampering (antenna wiring along device edges, display padding that looks disturbed, battery swaps), though note that the more advanced implant variant leaves no obvious external trace.
Report confirmed losses to local law enforcement and to Ledger's official support channels only — never to anyone who contacts you first claiming to be Ledger support.

For security teams and incident responders

Treat hardware wallet supply chains as a viable implant vector; "Secure Element intact" attestation is not sufficient evidence that a device is untampered.
When advising crypto-holding clients, recommend purchases only through manufacturer-direct channels or explicitly manufacturer-authorized resellers, and flag steep discounts (near 50% off retail) as a red flag rather than a bargain.
Monitor for phishing and impersonation campaigns that piggyback on high-profile incidents like this one — threat actors routinely pose as the affected vendor's support staff within hours of disclosure.

For hardware wallet vendors generally

Evaluate tamper-evident packaging and in-field physical-integrity verification (e.g., weight/X-ray checks at point of sale, cryptographic pairing between device and first-boot attestation) that could catch implants added after manufacturing but before retail sale.
Reassess reseller vetting and agreements, particularly in regions where gray-market and discount reselling of security hardware is common.

Key Takeaways

Ledger confirmed on October 10, 2026, that devices sold through Southeast Asian reseller CryptoBilis contained unauthorized hardware implants that stole users' seed phrases.
The implant bypassed Ledger's Secure Element entirely by tapping the display's data lines and transmitting the on-screen recovery phrase over a hidden LTE/eSIM connection — meaning Ledger's Genuine Check could not detect the tampering.
On-chain researchers estimate $86 million to over $93 million stolen from 300+ wallets across Bitcoin, Ethereum, Tron, BNB Chain, and Polygon, with some trackers estimating total exposure above $100 million.
Evidence suggests the compromise may date back to June 2026 or earlier, well before the theft wave became publicly visible in October.
This was a supply-chain attack at the reseller level, not a flaw in Ledger's own manufacturing, firmware, or direct sales channels — but it demonstrates that hardware-level security guarantees can be undermined anywhere along the distribution chain.
Anyone who purchased a Ledger device through CryptoBilis or another steeply discounted, unofficial reseller should treat the device as compromised, move funds to a freshly generated wallet from a verified source, and watch for opportunistic phishing exploiting the disclosure.