A Ledger wallet spy implant is behind a wave of crypto thefts in Southeast Asia: on October 10, 2026, Ledger confirmed that a device sold through the Malaysia-based reseller CryptoBilis contained an unauthorized hardware implant. Researchers say the hidden chip read users’ 24-word recovery phrases during setup and sent them to attackers over a mobile network.
On-chain investigators estimate that tens of millions of dollars were drained from hundreds of wallets. Ledger has not confirmed a total, but the incident has shaken trust in a product many people buy specifically to keep their crypto safe.
Here is what happened, how the attack worked, why Ledger’s own “Genuine Check” did not catch it, and the steps every hardware wallet owner should take now.
Quick Answer: Ledger confirmed that hardware wallets sold by Southeast Asian reseller CryptoBilis contained a hidden LTE implant that captured recovery phrases during setup. If you bought from CryptoBilis, do not set up the device. If you already did, move your funds to a new wallet bought directly from Ledger, with a brand-new recovery phrase.
Key Takeaways
- On October 10, 2026, Ledger Support confirmed that “one of the impacted users’ devices contained an unauthorized hardware implant,” according to CoinDesk.
- Ledger says all confirmed cases involve devices sold through CryptoBilis, a reseller operating in Malaysia, Indonesia and the Philippines.
- Researchers say the implant used a microcontroller, an LTE radio and an embedded SIM (eSIM) to steal 24-word recovery phrases shown on the device screen.
- Loss estimates range from about $86 million to $103 million across more than 300 wallets, depending on the researcher; Ledger has not confirmed a figure.
- Ledger’s Genuine Check cannot detect added implants if the original Secure Element chip is intact, according to Ledger’s support guidance cited by BleepingComputer.
- Ledger says its internal systems and direct sales channels were not affected.
What Happened With Ledger and CryptoBilis?
A hardware wallet is a small physical device that stores the private keys to your cryptocurrency offline, so hackers cannot reach them through the internet. Ledger is one of the best-known makers; according to Cointelegraph, it has sold more than 8 million hardware wallets.
The trouble started with reports of missing funds from people who bought Ledger devices through CryptoBilis. Here is the timeline based on reporting by CoinDesk, BleepingComputer and Tech Times:
| Date (2026) | Event |
|---|---|
| September 16 | Some researchers say implanted Ledger devices were already on sale, at nearly half the price of genuine hardware (BleepingComputer). |
| October 8 | Mark Karpelès, former CEO of Mt. Gox, warned on X that Ledger devices with hidden cellular modules were circulating (Tech Times). |
| October 9 | Ledger opened an investigation into user losses and asked CryptoBilis to stop selling and shipping Ledger devices. |
| October 10 | Ledger Support confirmed an unauthorized implant in one impacted user’s device. CryptoBilis suspended hardware wallet sales. |
| October 11 | Ledger said impacted devices appear limited and that it was cooperating with authorities (CoinDesk). |
| October 12–13 | Wider reporting of how the implant worked; Trezor and OneKey cut ties with CryptoBilis (Cointelegraph). |
According to CoinDesk, Ledger said all confirmed cases “involve devices sold through the Southeast Asia reseller CryptoBilis,” and its internal systems and direct sales channels are unaffected.
How Did the Ledger Spy Implant Work?
A supply chain attack is a hack where criminals tamper with a product somewhere between the factory and the customer, instead of attacking the customer directly. That is what researchers believe happened here.
According to BleepingComputer, which cited analysis by Mark Karpelès and Tibane Labs, the implant worked like this:
- It sat hidden behind the screen. The antenna wire was the main visible sign of tampering.
- It watched the display and buttons. When a new owner set up the wallet, the device showed the 24-word recovery phrase on screen. The implant captured that output.
- It sent the phrase over LTE. Using an eSIM, the implant transmitted the recovery phrase to the attackers over a mobile data network.
- The attackers emptied the wallet. With the recovery phrase, anyone can rebuild the wallet on another device and move the funds.
Researchers found two versions, according to BleepingComputer. The first replaced the original battery with a smaller one to make room and had part markings scraped off. The second, more advanced version kept the original battery and fit into the foam padding under the OLED display using a professionally made flexible circuit board.
Tech Times reports that the implant tapped the SPI bus, the data connection between the Secure Element chip and the screen, and that the shrink wrap stayed intact. Ledger says the implants did not compromise the security chip itself or alter transactions, according to Cointelegraph.
Which Ledger models were affected?
Ledger has not published an official list of affected models. Tech Times reports that researchers and users described implanted Ledger Nano X devices, and that blockchain security firm SlowMist said Ledger Flex devices from the same network appeared in EU-linked reports.
Why Didn’t Ledger’s Genuine Check Catch It?
This is the most worrying part for owners. Ledger’s Genuine Check is a built-in test that confirms a device is authentic by verifying a certificate inside its Secure Element chip.
The problem is that the implant did not touch the Secure Element. It only listened to data traveling to the screen. According to BleepingComputer, Ledger’s own support page says Genuine Check cannot detect added implants if the original Secure Element remains intact. Tech Times went further, describing Genuine Check as “architecturally incapable of detecting” this kind of attack.
In plain terms: a device can pass every software check and still be bugged.
How Much Crypto Was Stolen?
Nobody has an official number yet. Here is what different researchers have estimated:
| Source | Estimated losses | Wallets affected |
|---|---|---|
| On-chain researchers cited by CoinDesk | $86 million to $93 million | More than 300 |
| Bitquery, cited by Tech Times | $92.9 million | At least 311 |
| Yfarmx, cited by Cointelegraph | $103 million | Not stated |
According to CoinDesk, Ledger has not confirmed an official loss figure. Tech Times reports that Tether moved to freeze USDT linked to the thefts.
Were Devices Outside Southeast Asia Affected?
So far, confirmed losses are tied to CryptoBilis. However, there are unverified reports elsewhere. According to Cointelegraph, an X user named Johannes said he found implants in two Ledger devices bought from separate MediaMarkt stores in Europe; Ledger has not confirmed any link to the CryptoBilis incident. Tech Times reports he found the implant before setting up the wallet and lost no funds.
BleepingComputer said it saw no indication that other Ledger resellers were shipping compromised wallets.
What Should Ledger Owners Do Now?
Whether or not you bought from CryptoBilis, this is a good moment to check your setup. Based on guidance from Ledger reported by CoinDesk and BleepingComputer:
- If you bought from CryptoBilis and have not set up the device, do not set it up. Contact official Ledger Support.
- If you already set it up, move your funds immediately to a new Ledger device bought directly from Ledger, using a brand-new recovery phrase. Do not reuse the old phrase.
- Buy only from official channels. Ledger warns that unauthorized resellers carry a higher risk of counterfeit or modified devices. Very low prices are a red flag; BleepingComputer reports implanted units sold for nearly half the normal price.
- Never type your recovery phrase into a website or app. Tech Times reports a fake Ledger site promoted through paid Google ads was asking for recovery phrases.
- Ignore unsolicited contact. Ledger says it will never call you, DM you, or ask for your 24-word recovery phrase.
- Report losses. Ledger urges affected users to contact support and file a police report.
Cointelegraph reports that Ledger has an inspection guide for customers who bought elsewhere, but it warns that opening a device can damage it, so back up your recovery phrase first.
If you are new to crypto security basics, our Blockchain & Crypto section explains the essentials in plain English.
What Does This Mean for Hardware Wallet Security?
Hardware wallets are still far safer than leaving coins on an exchange for most people, but this incident proves the device is only as safe as the path it took to reach you.
Key lessons:
- Physical tampering is real. Software checks cannot always detect hardware changes.
- Resellers are a weak point. Ledger says it is reviewing authorized reseller controls, has banned restocking of returned products, and is calling for industry-wide chain-of-custody improvements, according to CoinDesk.
- The whole industry is reacting. According to Cointelegraph, Trezor said it found no tampered Trezor devices sold through CryptoBilis but removed the reseller, while OneKey terminated CryptoBilis and is offering replacements for devices bought from it between March 1 and October 12, 2026.
It is also not the only hardware wallet scare this year. CoinDesk notes that in July 2026, a flaw in Coldcard’s seed-generation firmware let attackers drain an estimated $100 million to $130 million in bitcoin, according to on-chain researchers.
Crypto rules are changing fast around the world too. For example, read how Japan slashed crypto taxes from 55% to a flat 20%, a move that could bring many new buyers into the market, and many new hardware wallet owners.
What to Watch Next
- An official loss total from Ledger and any law enforcement findings.
- Who tampered with the devices. Tech Times reports that CryptoBilis changed ownership in August 2026, but there is no public evidence linking the sale to the attack and no criminal attribution has been made. Claims on social media remain unverified.
- Confirmation of the European reports involving MediaMarkt-bought devices.
- New hardware protections that Ledger says it is developing.
For more breaking security stories, follow our Cybersecurity News section.
Frequently Asked Questions (FAQ)
Was Ledger hacked?
No, Ledger says its internal systems and direct sales channels were not affected. Instead, some Ledger hardware wallets sold through the Southeast Asian reseller CryptoBilis were physically tampered with and fitted with a spy implant. Ledger confirmed the implant on October 10, 2026, and says all confirmed cases involve CryptoBilis-sold devices.
What is CryptoBilis?
CryptoBilis is a Malaysia-based hardware wallet reseller that was listed as authorized in Malaysia, Indonesia and the Philippines. After Ledger confirmed implanted devices, CryptoBilis suspended all hardware wallet sales and temporarily closed its physical stores, according to Cointelegraph. Trezor and OneKey also cut ties with the reseller.
How do I know if my Ledger has a spy chip?
The safest sign is where you bought it: confirmed cases involve devices sold by CryptoBilis. Ledger’s Genuine Check cannot detect an added implant if the Secure Element chip is intact. Researchers say the antenna wire behind the screen is the main visible sign, but opening a device can damage it, so back up your recovery phrase first.
Does Ledger Genuine Check detect implants?
No, not this type. Genuine Check verifies a certificate stored in the Secure Element chip. The CryptoBilis implant did not alter that chip; it only read data sent to the screen. According to Ledger’s support guidance cited by BleepingComputer, Genuine Check cannot detect added implants if the original Secure Element remains intact.
How much crypto was stolen in the Ledger CryptoBilis attack?
Estimates range from about $86 million to $103 million. On-chain researchers cited by CoinDesk estimated $86 million to $93 million from more than 300 wallets, Bitquery estimated $92.9 million from at least 311 wallets, and Yfarmx estimated $103 million. Ledger has not confirmed an official total.
What should I do if I bought a Ledger from CryptoBilis?
Do not set up the device if it is still new. If you already set it up, move all funds to a new Ledger bought directly from Ledger, using a brand-new 24-word recovery phrase. Contact official Ledger Support and file a police report if you have lost funds.
Is it still safe to use a hardware wallet?
Yes, for most people a hardware wallet bought directly from the manufacturer is still one of the safest ways to store crypto. The CryptoBilis attack targeted the supply chain, not the wallet’s core security chip. Buy only from official stores, avoid suspiciously cheap devices, and never share your recovery phrase.
Final Thoughts
The Ledger wallet spy implant is a reminder that crypto security starts before you ever switch on your device. A wallet can be genuine, pass every check and still be compromised if someone tampered with it along the way. Buy direct, guard your recovery phrase like cash, and act quickly if you bought from CryptoBilis.
Security habits matter for traditional money too. Learn how card security codes protect you in our guide, What Is a CVV Number?, on CyReader.
Sources
CoinDesk — Coldcard exploit shakes faith in self-custody (July 2026)
BleepingComputer — Ledger confirms spy chip implant behind wallet crypto thefts
CoinDesk — Ledger says unauthorized implant found in at least one device sold by CryptoBilis
Tech Times — Ledger Hardware Wallet Supply Chain Attack: Genuine Check Passes on Implanted Devices
