Ledger’s spy chip scandal: Can hardware wallets still guard crypto’s cold storage?

Traders Union
All News
Editors' Picks
Ledger’s spy chip scandal

Confirmed implant and the scale of losses

Ledger’s confirmation of an unauthorized hardware implant has exposed many hidden problems of its wallets. The major risks are observed among buyers who purchased devices through the Southeast Asian reseller CryptoBilis. Ledger states that its systems do not have any vulnerabilities. Blockchain analysts at Bitquery counted approximately $93.2 million taken from 315 wallets spanning Tron, Bitcoin, Ethereum, BNB Chain, Polygon and Solana. Tether froze about $10 million in related USDT. Ledger has not confirmed these figures yet.

View post on X Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

On October 10, Ledger Support posted a situation update stating:

“Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant.”

The company is cooperating with authorities and the security collective SEAL 911. It has requested CryptoBilis to halt all hardware-wallet sales.

“We have no indication that Ledger’s security infrastructure, systems or services have been compromised,” the statement added.

Anatomy of the spy module

Researchers describe a sophisticated physical modification that did not require a software exploit or breach of a secure element. Former Mt. Gox chief executive Mark Karpelès examined a Ledger Nano X purchased in Malaysia, and he found a small circuit board.

“My spy-implanted Ledger came from Malaysia and had flawless shrink wrap,” he wrote. “Even opening it, at first you don’t see the implant which is cleverly hidden where the screen’s padding is supposed to be.”

View post on X Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

The implant typically includes a microcontroller, a cellular or LTE module, an eSIM, and an antenna. When the device generates its 24-word recovery phrase during initial setup, the module can reconstruct the words from the pixel stream and transmit them over the cellular network. As the secure element remains genuine, Ledger’s “Genuine Check” still passes. So a typical user has almost no chance to recognize a problem.

A channel issue, not a factory failure

Ledger has stated that the incident is limited to devices sold through CryptoBilis, an authorized reseller who works in Indonesia, Malaysia, and the Philippines. Currently, there are no cases showing any issues with devices purchased directly from Ledger’s own store. The company notes that no global supply chain is immune to interception once products leave the factory. CryptoBilis’ former co-founders have stated the business changed ownership earlier in 2026, thus claiming they are not responsible for these drains.

View post on X Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

The pattern of on-chain activity shows multiple wallets authorizing the same spender within seconds. This proves that the cases are the examples of coordinated access to private keys rather than individual phishing attempts. Yet Ledger has not tied every drained address to a confirmed implant as the internal investigation continues.

Expert scrutiny and earlier warnings

Hardware analysts have determined that the module passively monitors unencrypted display traffic without attacking the secure element. Later iterations, according to Karpelès and Tibane Labs, reduced visible wiring. This preserved the original battery to survive casual inspection. The experts have presented new video tutorials for users to verify their devices.

View post on X Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

SlowMist’s chief information security officer stated that such a module could log recovery phrases. However, a complete understanding of the major underlying causes requires investigation. The scandal also led to new phishing attempts: fake Ledger websites and apps appeared in search results. Ledger’s representatives reminded that the company will never request a user’s 24-word phrase.

Implications for cold storage

Hardware wallets are traditionally viewed as the gold standard of self-custody because private keys do not leave the device. However, this scandal shows a new type of risk that may occur at the distribution layer. Ledger says it is “working on further, enhanced anti-tampering solutions” and advises users to buy only from official channels and to visually inspect the wallets before setup.

View post on X Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

Forensic work will indicate the full scale of losses, as there is a high likelihood that many cases are still not documented. So we recommend treating any device from the affected channel as potentially compromised. If funds may be at risk, generate a new seed phrase on a trusted (new) wallet.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.