Ledger spy chip scandal raises fears over crypto wallet security

Paris-based Ledger is reviewing its reseller controls and anti-tampering protections after spyware planted in some wallets led to roughly $90 million in stolen crypto.

Ledger describes the thefts as a physical supply-chain attack, not a breach of its software or internal systems.

How the implant worked

In an investigation update on X, Ledger said a spy chip inside devices sold by Southeast Asian reseller CryptoBilis read users' 24-word recovery phrases off the screen and sent them over a mobile network using an eSIM.

Ledger said the implant did not touch the secure element or alter transactions.

In a post on X, Mt. Gox's former CEO Mark Karpelès said he found a spy implant in an unused Ledger Flex bought at Singapore's airport.

Related: Dave Ramsey's investing advice falls short, study finds

Buyer Ben Yorke bought it from the airport and identified Metapod as the retailer. Ledger says every confirmed loss so far traces to CryptoBilis devices, and it has not verified a theft involving a wallet bought elsewhere.

Retail fallout

Reports also surfaced of tampered devices bought from German retailer MediaMarkt. A MediaMarktSaturn spokesperson told Bloomberg the group has removed all of the manufacturer's products from its stores and online platforms.

In a post on X, CEO Pascal Gauthier said "Physical supply chain tampering is a risk for the whole industry." He added that Ledger is reviewing controls on direct sales and resellers.

“Some claims and figures circulating online are unverified. Scammers often try to take advantage of incidents like this. Rely only on official Ledger channels for updates,” he mentioned.

Trending on TheStreet Roundtable:

• Google now lets anyone check if an image was made with AI
• Wall Street's youngest CEO of his day predicts $1M Bitcoin
• Trump buys surging stocks, dumps Coinbase

CTO Charles Guillemet asked users to send suspicious devices to Ledger. The company says its investigation into who tampered with the devices is ongoing.

“If you bought a Ledger signer from CryptoBilis and have not set it up, do not set it up. If you have set it up, transfer your assets promptly to a new signer with a new recovery phrase,” he alerted.

Losses and advice

Galaxy Digital research put losses above $90 million. CoinDesk cited onchain estimates of up to $93.2 million across more than 300 wallets, with Tether freezing $10 million of USDT.

Ledger has not confirmed total victims or losses. It told CryptoBilis customers not to initialize unused devices, and those who already did to move funds to a new device with a fresh recovery phrase.

Related: If you invested $1,000 in Bitcoin when Trump took office in 2017 vs 2025, here's how much you'd have made or lost