Ledger confirms a hidden chip drained wallets sold by one reseller

Ledger has confirmed that a hidden electronic implant, built into some of its hardware wallets, copied users' secret recovery phrases and helped drain their crypto. Every confirmed case traces to devices sold by a single reseller in Southeast Asia.

The Paris company said on October 9 it was investigating fund losses among buyers in the region. A day later it confirmed tampering on at least one device. By October 11, Ledger said every confirmed drain was linked to wallets bought through a reseller called CryptoBilis.

How much was taken is still not settled. Specter, a pseudonymous blockchain investigator, put the figure above $86 million after tracing suspect addresses across Bitcoin, Ethereum and Tron. A second researcher, tanuki42, counted more than $72 million. Ledger has not confirmed a total, or how many devices carried the implant. It called the number of affected wallets limited.

What Ledger found inside the device

Ledger described the implant in a technical update on October 13. The chip sits inside the wallet's case, beside the real electronics, and reads what the screen shows. When a new device is set up, the screen displays the 24-word recovery phrase that controls the funds. The implant captured those words. Its tiny processor then sent them out over a mobile connection, using a built-in eSIM. The chip did the rest.

One detail matters for every Ledger owner. The implant did not touch the Secure Element, the protected chip that guards private keys, and it did not change any transaction. Because the genuine chip was left alone, Ledger's built-in Genuine Check could not flag the device as fake. The company said plainly that the check cannot catch every physical change when the Secure Element is intact.

Mark Karpeles, the former chief executive of the collapsed Mt. Gox exchange, examined the hardware and called the implant 'quite an evolution' from older tampering that relied on manually soldered wires. Research studio Tibane Labs said it found two versions of the chip.

Why only buyers from one reseller were hit

CryptoBilis is listed as an official Ledger reseller in Indonesia and Malaysia, which is part of why the case stung. These were not obvious fakes from a street stall. Buyers believed they were getting the real thing, and in a narrow sense they were, because the genuine chip inside still worked. Bought from a reseller. That was the whole difference.

This is not a flaw in Bitcoin, and it is not a break in Ledger's own chips. It is a break in the path a box takes from factory to buyer. A tampered device slipped into that path somewhere before it reached the customer. Ledger said its own systems, infrastructure and direct sales were not affected.

One report from Europe briefly widened the worry. A customer in Germany said a device bought in a MediaMarkt Saturn store carried an implant, and the retailer paused in-store Ledger sales. Ledger said that case involved no reported losses, and that its checks across Europe found no tampering and no missing funds. As a precaution it still asked sellers across Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to pull devices from shelves.

Where a wallet is bought now matters as much as which wallet it is, the same point at the heart of this guide to choosing a wallet and staying safe.

How big the losses could be, and what is unknown

Estimates have climbed as more addresses were traced. Early on, Specter's count sat above $86 million. Later readings from other analysts reached about $93 million drained from more than 300 wallets. None of these totals is confirmed. They come from pseudonymous researchers reading public blockchain data, not from Ledger or any auditor.

The spread itself is telling. The gap between the low count, above $72 million, and the high one shows how rough these early figures are. Numbers like these shift as investigators merge or split clusters of addresses. A firmer total may take weeks.

What Ledger told owners to do

Ledger's advice was specific. Anyone who bought a device from the reseller in the previous 90 days should not start setting it up. Owners who had already set one up were told to move their coins to a new Ledger signer protected by a fresh recovery phrase, generated on the new device. The company also warned that offers to recover stolen funds are almost always scams.

CryptoBilis echoed one basic rule in its own notice. A recovery phrase must be created by the device during setup. If the words arrived pre-printed, or anyone else could have seen them, the wallet should be treated as unsafe and abandoned. That single habit, insisting the device makes its own phrase in front of its owner, is the cheapest defense against a tampered box.

A wider lesson sits underneath the technical detail. Changpeng Zhao, the Binance co-founder known as CZ, wrote that the early evidence pointed to a supply chain attack through one vendor, and added, 'Self-custody comes with extra responsibilities.' A threat like this has nothing to do with the cryptography behind Bitcoin itself, a separate worry explored in this look at whether quantum computers could break Bitcoin.

What to watch

Who built and planted the chip is the biggest open question, and how it entered the supply chain is close behind. Ledger said it is working with authorities to find whoever is responsible. Watch for a confirmed loss total, a device count, and any word on whether other resellers were touched. CryptoBilis has halted sales of its wallet stock while the investigation runs. It has said little else.