Ledger Buyers Lost Millions as Spy Chip Found Inside a Wallet

• Ledger confirmed an unauthorized hardware implant inside a customer’s device.
• The affected wallets were bought through CryptoBilis, a reseller listed as authorized.
• Independent loss estimates remain unverified by Ledger.
• The genuine check validates the secure chip and cannot see added circuitry.

Ledger confirmed on October 10 that a device belonging to an affected customer contained an unauthorized hardware implant, one day after the company opened an investigation into funds disappearing from wallets bought through CryptoBilis, a Southeast Asian reseller it listed as authorized. The company reported no indication that its own infrastructure or services had been compromised, which places the attack in the physical supply chain between the factory and the buyer. Blockchain analytics firm Bitquery puts the on-chain damage at roughly $92.9 million across 311 wallets, a figure Ledger has yet to verify.

A cellular modem beneath the screen sends the recovery phrase to the attacker

Research published by Tibane Labs describes modified Ledger Nano X units carrying extra circuitry on the internal lines that feed the display. When a new owner sets up the wallet, the genuine secure element generates the recovery phrase and sends each word to the screen, and the implant reconstructs those words from the display data before a cellular modem with an eSIM and a custom antenna transmits them to the attacker. Nobody has to crack the chip, guess the PIN or trick the owner into signing anything, because whoever holds the phrase can rebuild the wallet on another device and wait for it to be funded.

Tibane Labs documented three generations of the hardware. The earliest used visible wires and a smaller replacement battery, later units moved to purpose-built flexible circuit boards, and the newest keeps the original battery while hiding the implant beneath the screen. The lab bought its specimens through Japanese marketplaces and states that it has established no link between them and CryptoBilis, while Ledger has yet to say whether every reported victim received the same design.

From a Reddit warning to a confirmed implant August 2025 A Reddit user warns about a suspicious Nano X May 2026 Hardware researcher Joe Grand presents a reverse-engineered implanted wallet September 2026 Tibane Labs acquires two more modified devices through Japanese marketplaces October 9, 2026 Ledger opens its investigation and asks CryptoBilis to halt sales and shipments October 10, 2026 Ledger confirms an unauthorized implant in a customer’s device Sources: Tibane Labs, Ledger

The genuine check clears any device that still carries its original chip

Ledger’s own security documentation says the genuine check verifies the authenticity of the secure element, and the same documentation acknowledges that the test cannot necessarily identify physical modifications when the original chip stays in place. A wallet can therefore be electronically authentic while carrying a second, hostile circuit, and buying from an authorized reseller does nothing to close that gap.

Protection What it establishes Detects an implant Genuine check The secure element is an authentic Ledger chip No Secure element Private keys stay protected inside the chip No Supply-chain integrity Nobody modified the device before delivery No built-in test

Ownership of the reseller changed hands months before the thefts, according to former CryptoBilis co-founders Arravind Prabu and Vimalatheethan, who said in a statement posted on LinkedIn that new owners acquired the company earlier this year, that they completed the handover in March 2026 and that they have had no access to backend systems, customer databases or order histories since then. The two say they still advised the incoming management around industry events such as Bitcoin Pizza Day, without visibility into daily operations or IT infrastructure. Under the acquisition agreements all parties had to hold off on a joint public announcement until mid-October 2026, although the statement says suppliers were notified of the change, and the founders remain open to giving Ledger historical context for its review. They name Nicholas Chang as the current person in charge of CryptoBilis, and no public evidence ties him or the new owners to the implants.

25 TRON wallets emptied within three seconds suggest a single operator

Bitquery followed the stolen funds across TRON, Bitcoin, Ethereum, BNB Chain and Polygon, and the transaction pattern suggests one party holding a stockpile of recovery phrases. On TRON, 25 wallets were emptied within three seconds of each other, after roughly two weeks of small test transfers. More than 80% of the victim wallets received their first deposit from June 2026 onward, which hints at when the tampered units entered circulation, although a funding date does not prove a purchase date.

Part of the money is already out of reach, since Bitquery traced 1,254 ETH into the mixing protocol Tornado Cash on October 9, while Tether froze about $10 million in USDT held in suspected attacker wallets, a step that blocks the funds without returning them to victims. Other independent estimates of the total range from $86 million to $94 million. A teardown video circulating on X shows a disassembled unit with added circuitry, yet the claim attached to it that every wallet the reseller shipped was modified has not been established by Ledger or by the investigators.

JUST IN: UP CLOSE VIDEO SHOWS HOW HACKERS STOLE OVER $80,000,000 SILENTLY CORRUPTING LEDGER #BITCOIN WALLETS

A SCAM SHOP IN MALAYSIA WAS LISTED AS AN "OFFICIAL AUTHORIZED RESELLER FOR YEARS"

BEHIND THE SCENES, CRIMINALS WERE INSERTING MICROSCOPIC SPY CHIPS ON EVERY WALLET

THEY… pic.twitter.com/aU9DfroWqJ

— The Bitcoin Historian (@pete_rizzo_) October 11, 2026

Resetting a CryptoBilis device leaves an already captured phrase exposed

Ledger is advising customers who bought through CryptoBilis in the past 90 days to leave uninitialized devices untouched, and those who already set one up should move their assets to a wallet created with a completely new recovery phrase on trusted hardware. Resetting the suspect device or restoring the old phrase elsewhere changes nothing if the words have already been transmitted. Affected users should also expect unsolicited offers of recovery help, and no legitimate support agent will ask for a recovery phrase.

CryptoBilis has stopped selling hardware wallets, and Ledger says it is contacting affected customers, cooperating with authorities and developing additional anti-tampering measures. Open questions include how many modified units remain in circulation, at which stage of distribution the implants were installed and who compensates buyers when an authorized channel delivers tampered hardware.

The implant case arrives less than two months after Ledger disclosed three flaws that also concerned what the wallet’s screen shows. On August 27 Ledger published three security bulletins, one covering a Secure SDK flaw that let a malicious host alter transaction parameters after they appeared on the display, and two covering Ethereum app bugs fixed in version 1.22.3, including one that showed a single operation while the signature authorized 257. Ledger reported no evidence that any of the three was exploited, whereas the October case comes with reported losses and no software patch that can remove a physical component.

The post Ledger Buyers Lost Millions as Spy Chip Found Inside a Wallet appeared first on ETHNews.