Ledger Found a Spy Implant Inside a Wallet Sold by Its Own Reseller After $86 Million Vanished From Buyers

A hardware wallet makes one promise: your recovery phrase never leaves the device. Hundreds of buyers in Southeast Asia kept their part of the deal, bought from a listed reseller, and still watched their crypto disappear. Now Ledger says at least one of those devices had something inside it that should not have been there.

"Ledger can confirm that one of the impacted users' devices contained an unauthorized hardware implant," the company posted on October 10. It is contacting affected users and working with authorities, and it says there is "no indication that Ledger's security infrastructure, systems or services have been compromised."

A board under the screen

The devices in question were sold by CryptoBilis, which sells in Indonesia, Malaysia and the Philippines and is described as an official Ledger reseller. On October 9, Ledger said it was investigating fund losses among Southeast Asian customers of the reseller and asked it to pause all sales and shipments. According to Ledger, CryptoBilis has since stopped selling all hardware wallet inventory until the investigation is done.

Photos and videos posted on X and Threads appear to show a small circuit board tucked under a wallet's screen. As the Verge describes it, the implant allegedly reads whatever is displayed, including the recovery phrase shown during setup, and sends it out through an embedded SIM card.

That would defeat the whole design. A recovery phrase is 24 words, and anyone holding them can rebuild the wallet and spend from it without ever touching the device. There is no indication that wallets bought directly from Ledger are affected.

Hundreds of wallets in minutes

The on-chain record looks less like a string of thefts and more like a single switch being flipped. On-chain researchers tanuki42 and Specter posted addresses with losses above $86 million. Blockchain data firm Bitquery's own count, which Ledger has not confirmed, puts the total at about $93.2 million from 315 wallets across TRON, Bitcoin, Ethereum, BNB Chain, Polygon and Solana. Most of it was USDT on TRON.

The timing is what stands out. The thief hit six chains within 47 minutes. On TRON, 25 wallets signed the same approval for the same address within three seconds, and $29 million in USDT was pulled within six seconds of the first approval. On Bitcoin, 111 wallets were emptied in a single block.

"People do not act like this. Software that already held every key does," Bitquery wrote. The firm points to one actor holding all the keys after about two weeks of test runs. Drains continued after Ledger's first post. Tether froze about $10 million, and some funds moved into Tornado Cash.

Confirmed versus counted

Ledger has confirmed one implanted device. It has not said how, when or by whom the implant was added, how many devices are involved, or how much was lost. The dollar figures come from researchers reading the blockchain, not from the company.

Most supply chain attacks live in code, like the campaign where attackers hijacked Brevo widgets to reach 100,000 sites. This one appears to have lived in the box itself, somewhere between the factory and the buyer.

Ledger's guidance is narrow. Anyone who bought from this reseller in the last 90 days should not start setup, and those who already have should "consider moving assets to a new Ledger signer (with new seed)."

Some offers on this page may be paid placements or contain affiliate links.