Ledger: spy chip in CryptoBilis wallets, $93 million stolen

Ledger, the French maker of cryptocurrency hardware wallets, has confirmed that at least one device sold by the reseller CryptoBilis contained an unauthorized hardware implant. The implant, hidden under the screen, reads the recovery phrase (seed) while the wallet displays it during setup and sends it to the attacker over an LTE connection using an eSIM. With the phrase in hand, the attacker rebuilds the wallet elsewhere and empties it whenever they choose.

The story is reported by Help Net Security, BleepingComputer, The Hacker News and heise Security. The technical details come from analyses published by Mark Karpelès (former CEO of Mt. Gox) and Tibane Labs, not from Ledger, which has not yet explained how the implant works.

What happened

• 9 October 2026: users in Southeast Asia report drained wallets. Ledger opens an investigation and asks CryptoBilis, a large Malaysia-based reseller, to stop selling and shipping its devices.
• 10 October: Ledger confirms that the device of one of the affected users contained an unauthorized hardware implant; it is working with the authorities to identify those responsible.
• 11 October: in its 72-hour update, Ledger states that all confirmed cases involve devices sold through CryptoBilis, that the number is “limited” and that its own systems and direct sales channels were not compromised. CryptoBilis has stopped selling hardware wallets.

According to researchers analysing blockchain transactions, quoted by Help Net Security, suspected losses exceed $93 million. BleepingComputer reports that some researchers had been showing the implant since 16 September, and that tampered devices were on sale for roughly half the price of the original.

Ledger has not named the model involved; Karpelès refers to the Ledger Nano X. It is not clear when, or at which point in the distribution chain, the devices were tampered with.

Technical details

How it works, according to Karpelès. The device he bought and opened contains a small board hidden under the screen, in place of the display padding, carrying a microcontroller, an antenna, an LTE module and an eSIM. The implant watches what appears on the screen and the button presses, extracts the words of the recovery phrase and sends them over the cellular network. The wallet arrived in intact shrink wrap and passed Ledger’s Genuine Check, because the security chip is authentic. Karpelès describes it as an evolution from earlier versions with hand-soldered wires.

Two variants, according to Tibane Labs. The researchers analysed two units bought in Japan, one on Amazon Japan from a Chinese seller shipping from Malaysia, the other on Yahoo! Auctions:

• first variant: the original battery is replaced with a smaller one that powers both the wallet and the implant. Under the battery and antenna sits an ST STM32G431KBU6 microcontroller (Arm Cortex-M4, 128 KB flash, UFQFPN-32 package), next to it an eSIM in an 8-pad 2×2 mm package and a shielded LTE module;
• second variant, more advanced and similar to the one Karpelès found: it uses the original battery, sits in the space of the padding under the OLED display and has the markings scraped off the microcontroller and the eSIM. It is a flexible circuit designed and mass-produced by a PCB manufacturer, not a hand-built one-off.

In both variants the visible clue is the antenna wire: along the top edge in the second, taped over the battery and LTE module in the first. You have to open the device to see it.

Why the checks are not enough. Genuine Check verifies the authenticity of the Secure Element. Ledger itself warns that it cannot detect added components when the original Secure Element is intact. The implant does not touch the keys in the chip: it reads them from the screen, at the moment the wallet shows them to the user. And since it uses the cellular network, its traffic never crosses the user’s own network.

The sources differ on the origin. Help Net Security writes that Karpelès bought the device in Malaysia; according to BleepingComputer he bought it from a Chinese seller on a well-known platform, shipped from Malaysia, without naming CryptoBilis.

MITRE ATT&CK (our mapping from the reported facts): T1195.003 (Supply Chain Compromise: Compromise Hardware Supply Chain), T1011 (Exfiltration Over Other Network Medium). No indicators of compromise, such as addresses or destination servers, have been published.

Impact for European and Italian companies

The confirmed cases are in Southeast Asia, but the sales channel was not a flea market: CryptoBilis was an authorized reseller. According to Help Net Security, an X user claims that wallets sold in Europe by an official reseller may also have been tampered with: the claim is unverified, Ledger has not commented on it and BleepingComputer reports no sign of other resellers being involved.

For companies that hold cryptocurrency in their treasury, accept crypto payments or manage client funds, the risk is concrete. The lesson, however, applies to any physical security device, such as FIDO keys and authentication tokens: chip attestation does not guarantee that the rest of the device is intact. For NIS2 entities, Article 21 requires measures for supply chain security, and the purchasing channels for security hardware are part of it.

Bitquery, a blockchain analytics company, notes that more than 80% of the drained wallets it traced first received funds from June onwards. This suggests that devices bought earlier than the 90 days covered by Ledger’s advice may also be compromised.

What to do now

1. Inventory your company’s hardware wallets: model, serial number, purchase channel and date, and who initialized them.
2. Devices bought from CryptoBilis: if they are not set up yet, do not initialize them. If they are in use, move the funds to a new wallet bought directly from the manufacturer, with a new recovery phrase generated by the new device. Include purchases older than 90 days.
3. Devices bought on marketplaces, at auction or at very low prices: treat them the same way. Genuine Check alone cannot rule out the implant.
4. Purchasing rules: buy security hardware directly from the manufacturer or from verified resellers. Exclude used, returned or restocked products and keep proof of purchase.
5. Monitor the addresses of company wallets, with alerts on any unauthorized outflow.
6. Watch out for phishing: Ledger warns that scammers will use the news to contact users. Ledger never calls, never sends direct messages and never asks for the 24-word recovery phrase; brief whoever manages the treasury.
7. If funds are stolen, contact Ledger support only through official channels and file a complaint with law enforcement.

Last updated: 13 October 2026