Ledger Confirms Spy Chip Implant in Hardware Wallets Behind $93 Million Crypto Theft

Ledger has confirmed that some of its hardware wallets sold through a Southeast Asian reseller contained a hidden circuit implant that silently transmitted users' recovery phrases to attackers, who then drained their cryptocurrency. On-chain analytics firm Bitquery estimates more than $93 million was stolen from at least 315 wallets across six blockchains in what Ledger refers to internally as the "draining incident of October 9th, 2026."

This matters because hardware wallets exist specifically to keep private keys and recovery phrases off internet-connected devices, where they're vulnerable to malware. A tampered device that defeats that isolation at the physical layer — while still passing the manufacturer's own authenticity check — undermines the core security promise the product is sold on, not just a software feature.

What happened

Researchers reported seeing the implanted hardware in Ledger X devices as early as September 16, 2026, sold at nearly half the normal retail price. Users in Southeast Asia began reporting drained wallets around October 9. Ledger opened an investigation that day and asked the reseller, Malaysia-based CryptoBilis, to stop selling and shipping its devices. On October 10, Ledger confirmed that at least one affected device contained "an unauthorized hardware implant." In a 72-hour update on October 11, the company said every confirmed case traced back to CryptoBilis-sold units and described the scope as "limited," though it has not disclosed a victim count or total loss figure of its own.

How the implant worked

Independent analysis by security researchers, including former Mt. Gox CEO Mark Karpelès and researchers at Tibane Labs, found a small circuit board hidden inside the device — in one variant, fitted into the foam padding beneath the OLED screen and running off the original battery; in another, paired with a smaller replacement battery to make room for the extra components. The boards reportedly use an STM32G431KBU6 microcontroller, a miniature eSIM, and a shielded LTE module. The implant reads the recovery phrase as it's displayed on screen during setup and transmits it to the attacker over a cellular connection — never touching the device's secure element chip, which is why Ledger's own Genuine Check authenticity verification could not detect the tampering. Component markings were reportedly scraped off to hinder forensic analysis.

Scope and response

Ledger says its own manufacturing systems and direct sales channels were not compromised, and the company is working with law enforcement to identify those responsible. Bitquery's on-chain analysis found that more than 80% of the drained wallets first received funds in June 2026 or later, suggesting the compromise window may extend beyond the 90-day purchase period Ledger initially flagged. Retailer MediaMarktSaturn pulled Ledger's crypto hardware wallets from its shelves and website as a precaution, and an unverified report claims a tampered device was found at a Singapore airport retailer; Ledger has not commented on either claim directly.

What affected users should do

Ledger is advising anyone who purchased a device through CryptoBilis not to initialize it. Anyone who has already set up a device bought through that channel should move their assets to a new device with a freshly generated seed phrase, ideally purchased directly from Ledger or another authorized retailer. The company is also warning that scammers may try to exploit the news by impersonating Ledger support — it says it will never call, message, or ask a customer for their 24-word recovery phrase under any circumstance.