Ledger, the maker of popular cryptocurrency hardware wallets, has confirmed that some of its devices sold through a Southeast Asian reseller were secretly modified with a spy chip that siphoned off users’ funds. The implant captured the secret recovery phrase needed to control a wallet and sent it to attackers wirelessly, turning a device meant to keep crypto safe into the very tool used to steal it. The case is a stark reminder that even “cold storage” hardware wallets are only as trustworthy as the supply chain that delivers them.

What happened with CryptoBilis-sold devices

Ledger began investigating in early October after users who had purchased devices through CryptoBilis, a Malaysia-based hardware wallet retailer operating across Southeast Asia, reported unexplained losses of cryptocurrency from their wallets. On October 9, Ledger opened a formal investigation and asked CryptoBilis to halt sales and shipments of its devices. The following day, Ledger confirmed that at least one affected device contained an unauthorized hardware implant, though the company said it is still unclear exactly how or when the tampering occurred.

In a more recent update, Ledger said that all reported incidents of unexpected fund drains were tied to devices sold through CryptoBilis, and it described the scale of the affected volume as “limited.” The company has not publicly disclosed exactly which device models were compromised, but it is working with authorities to track down whoever built and distributed the tampered hardware.

How the spy implant actually works

Independent researchers had been flagging the tampered devices since mid-September, well before Ledger’s public confirmation. Mark Karpelès, former CEO of the Mt. Gox exchange and now CTO at Shells.com, shared images of the implant found inside a Ledger Nano X, calling it “quite an evolution” compared to earlier, more crudely soldered tampering attempts. This version was hidden behind the device’s screen, with only a telltale antenna cable hinting that something inside the hardware wasn’t original.

According to Karpelès, the malicious chip worked by capturing the device’s display output and recording button presses, which allowed it to reconstruct the seed phrase, the master key that controls all funds in a crypto wallet. The implant then transmitted that stolen seed phrase to attackers over an LTE cellular connection using an embedded eSIM, meaning it didn’t need the victim’s phone or Wi-Fi network to send data out. “Ledger Nano X are used to store crypto. The spy implants are used to steal whatever crypto you store in those Ledger Nano X,” Karpelès explained.

Cryptocurrency research studio Tibane Labs independently confirmed these findings and said it had obtained two different versions of the implant built for the Ledger X. One tampered device was purchased on Amazon Japan from a listing described as a “China-based seller, shipped from Malaysia,” while researchers obtained another sample through a similar channel, pointing to a broader counterfeit or tampered-device pipeline rather than a single isolated incident.

Why this differs from typical crypto hacks

Most cryptocurrency thefts exploit software: phishing sites, malicious browser extensions, or compromised exchanges. Hardware wallets like Ledger’s exist specifically to avoid those risks by keeping private keys offline, isolated from internet-connected devices. This incident bypasses that entire security model by attacking the supply chain instead of the software layer. Rather than hacking a user’s computer, attackers physically modified the wallet before it ever reached the buyer, embedding a chip that defeats the wallet’s core promise of offline key isolation.

Karpelès noted that the compromised device he examined was not purchased through Ledger’s recommended retail channels, but from “a well known platform via a Chinese seller,” with the product shipped from Malaysia. This matches the pattern of devices sold through CryptoBilis, and researchers say these tampered units were offered for roughly half the price of genuine, unmodified hardware, a discount that likely helped drive sales while funding the scheme.

What users and developers should do now

For anyone who bought a Ledger device through CryptoBilis or a similarly unverified third-party reseller, Ledger’s guidance is direct: if you have not yet set up the device, do not initiate setup. If a device has already been configured and used, Ledger recommends moving all assets to a new, genuine Ledger signer with a freshly generated seed phrase, rather than trusting the existing one.

More broadly, this case underscores a practical rule for anyone buying hardware wallets, security keys, or any device meant to hold sensitive secrets: purchase only from the manufacturer directly or from explicitly authorized retailers. Marketplace listings offering steep discounts, especially from third-party sellers with unclear supply chains, carry meaningfully higher risk of tampering. Developers building products around hardware security modules should also take note that physical supply-chain attacks remain a viable and apparently profitable attack vector, even against purpose-built secure hardware.

Frequently asked questions

Is this a flaw in Ledger’s own software or firmware?
No. Ledger’s investigation points to a physical hardware implant added to devices after they left Ledger’s control, not a bug in the company’s official firmware or apps.

How can I tell if my Ledger device is affected?
Ledger has not published a public identification guide in the material confirmed so far, but it is reaching out directly to impacted users. If you bought your device through CryptoBilis or an unauthorized third-party seller, treat it as suspect and follow Ledger’s recommendation to transfer funds to a new device with a new seed phrase.

Does this affect all Ledger hardware wallets?
Based on confirmed reports, the issue is tied to devices sold through CryptoBilis, with researchers specifically identifying tampered Ledger Nano X units. Ledger has not confirmed the implant affects devices sold through its official store or authorized retailers.

Source: Ledger confirms spy chip implant behind wallet crypto thefts