Ledger Confirms a Hidden Chip Was Found in a Crypto Wallet

The hardware wallet was supposed to be the one thing you could trust. Now Ledger itself has confirmed there was a second, unauthorized computer hiding inside one of its customers' devices — and nobody can say yet how many more are out there.

On Friday, October 10, Ledger's support account posted a "Situation Update" confirming that "one of the impacted users' devices contained an unauthorized hardware implant." That is the first time the Paris-based company — which says it has sold more than 7 million devices — has acknowledged physical tampering in its products. The acknowledgement came a day after Ledger said it was investigating reports of drained funds from users in Southeast Asia who bought their wallets through a reseller called CryptoBilis, and asked that reseller to pause all sales and shipments.

Let me be blunt about what that means: a hardware wallet is a little computer whose entire job is to keep your private keys sealed away from the internet. If someone got a second chip inside the case before you ever touched it, every promise the device makes on its screen is theatre. The cryptography never breaks. It doesn't need to.

What Ledger has actually confirmed

Separating what's confirmed from what's merely circulating is the whole ballgame here, because the numbers flying around are dramatic and the evidence is not. Here is what Ledger itself has said, in its own words.

On October 9, Ledger Support posted on X that it was "investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis" (Ledger's spelling, both variants in one post; the reseller calls itself CryptoBilis). As a precaution, the company wrote, it had asked CryptoBilis to "pause all sales and shipments of Ledger devices" while the investigation runs. Users who bought from the reseller in the last 90 days were told not to set up uninitialized devices; anyone who had already set one up should "consider moving assets to a new Ledger signer (with new seed)."

Photo: Motokoka, CC BY-SA 4.0, via Wikimedia Commons. File photo of a Ledger Nano S; the pictured device is not one of the tampered units.

The next day came the confirmation that matters: one affected user's device did contain an unauthorized implant. Ledger said it is reaching out to impacted users, asked anyone with information to contact its bounty programme, and added that CryptoBilis "has ceased sales of all hardware wallet inventory until the investigation is concluded."

Two things Ledger has been careful to say: "we believe the funds drained are limited to devices sold through a reseller named CryptoBilis in South East Asia," and "we have no indication that Ledger's security infrastructure, systems or services have been compromised." Read that the way it's written. Ledger is saying its own code and servers look clean — not that anyone else's supply chain is.

The screen-reader theory: how the implant allegedly worked

The most detailed technical account so far didn't come from Ledger. It came from Mark Karpelès — yes, the former Mt. Gox CEO, a man with his own catastrophic history in crypto custody — who posted teardown photos on X on October 9 of a Ledger he said he bought in Malaysia with the shrink wrap intact.

According to Karpelès, and relayed carefully by Gizmodo, the device contained a second board tucked where the screen's padding should have been, carrying an LTE module with a data eSIM. His account: the microcontroller recognises the Ledger font on the wallet's 128×64 display, spots the setup screen, and beams the 24-word recovery phrase out as a text message over LTE. Firmware can't catch it because the implant doesn't touch the main board at all — it just listens in on screen refreshes.

That is, to be clear, Karpelès's claim about his own device, not Ledger's finding. Gizmodo explicitly notes his photos are tied to the CryptoBilis investigation "only by timing and his own suspicion." Ledger has not said whether the implant it found matches this design. But the mechanism is horribly plausible, and it explains something important: a compromised device can still pass Ledger's own authenticity check. We know that for a fact, because it already happened. A teardown of a Thailand-bought Nano X — published at hardwear.io USA 2026 by researcher Joe Grand after a Reddit user found a second hand-wired board inside — showed the device powered on and passed Ledger's built-in genuine check anyway. That was August 2025.

Photo: Roderart, CC BY-SA 4.0, via Wikimedia Commons. File photo of a Ledger Nano X; the pictured device is not one of the tampered units.

The uncomfortable part: CryptoBilis was Ledger-approved

Here is the detail that should rattle anyone who has ever recited the standard crypto-safety mantra. CryptoBilis wasn't some sketchy marketplace seller. It was — and as of Ledger's reseller page, apparently is — an officially listed authorized reseller for Indonesia, Malaysia, and the Philippines, operating out of Kuala Lumpur with a walk-in store in Petaling Jaya. The shop sells Ledger alongside Trezor, Tangem, SafePal, CoolWallet, OneKey, and Ellipal.

The crypto industry has spent years drilling one sentence into newcomers: buy only from the manufacturer or an authorized reseller. This week that advice got colossally undermined. Ledger has not accused CryptoBilis of anything — "nothing public has shown that the shop altered devices," as Gizmodo put it, and the reseller could itself be a victim of tampering further up its own supply chain. The company said the reseller complied with the pause. But the point stands: the attack surface wasn't a back-alley listing, it was the approved channel.

Binance co-founder CZ put it dryly on X: "Self-custody comes with extra responsibilities." He described it as "a small number of people probably bought fake (or tampered) Ledgers" and a "localized" supply-chain attack, while urging ecosystem players to help trace and recover funds. AnchorWatch CEO Rob Hamilton was less sanguine, warning anyone who bought through the reseller to move funds now, and adding that "the blast radius could be larger than ledger." Both men are reacting in real time to incomplete information — but Hamilton's warning is the one that maps to the genuine-check bypass we already know about.

Nobody agrees on the damage

Now to the numbers, which you should treat the way Ledger does: unconfirmed. We went through five independent on-chain estimates published since October 9 and found none of them counting the same wallets, so they can't be added together.

The range runs from about $71.5 million to $93.4 million. Arkham Intelligence flagged an unverified "ledger-drainer" entity holding roughly $71.5 million across flagged addresses (about $29.4 million in ETH, $17.5 million in BTC, the rest in stablecoins). A pseudonymous investigator called Specter put the figure above $86 million "from hundreds of wallets" across Bitcoin, Ethereum, and Tron — then clarified he didn't actually know the wallet count yet. Bitquery counted $93.2 million across 315 wallets on six chains; another tracker, Yfarmx, counted $93.4 million across 471 addresses. A fifth estimate from tanuki42 landed north of $72 million and asked victims to contact the SEAL 911 security response group, which is now assisting with the investigation.

Ledger has verified none of these figures, and CoinDesk noted it's "unclear whether the incidents are connected" — some reported drains may trace to ordinary phishing rather than tampered hardware. That's not me defending the numbers down; it's the honest state of a 48-hour-old investigation. What we know is that at least one device had an implant, authorities are involved, and the drained funds are real even if the totals are fog.

This has happened before — just never like this

If you cover crypto security long enough, Ledger starts to look like a company with a target on its back and a talent for surviving hits that would sink anyone else. The record is grim reading:

2020: an e-commerce database breach exposed around a million email addresses and 272,000 detailed customer records — names, postal addresses, phone numbers — which were dumped publicly and fed years of phishing. A class action followed; one lawsuit sought $500 million.

December 2023: a supply-chain attack on Ledger's Connect Kit — an NPM account belonging to a former employee was phished, and malicious code was pushed into the software thousands of decentralised apps used to connect wallets. Between $480,000 and $600,000 was drained in a roughly two-hour window. Ledger phased out blind signing afterwards and pledged to reimburse victims.

January 2026: names and contact details of Ledger.com buyers were exposed through payment partner Global-e. No crypto was taken, but the address book of crypto's richest customers leaked again.

April 2026: a counterfeit "Ledger Live" app sat on Apple's Mac App Store for about a week, tricking victims into typing their 24-word recovery phrases into it. One musician lost roughly $424,000 in bitcoin alone; total losses were estimated near $9.5 million. Apple eventually removed it.

And then there's the precedent that haunts this week specifically: the August 2025 Thailand-bought Nano X whose implant passed the genuine-device check. Put that together with this week's CryptoBilis case and the pattern is ugly — the threats keep moving one step ahead of the defences Ledger tells customers to trust.

What Ledger is telling owners to do

The guidance is unusually blunt. If you bought a Ledger from CryptoBilis in the last 90 days and haven't set it up, don't. If you already did, "consider moving assets to a new Ledger signer (with new seed)" — in plain English, buy a fresh device from a different source and migrate everything. Ledger has published a guide on checking your device for physical tampering, and its "Genuine Check" page walks through the software-side verification. But after the Joe Grand teardown, "it passed the genuine check" is no longer the all-clear it used to be.

One open question nobody at Ledger has answered yet: CryptoBilis sells six other wallet brands. Is a Trezor or Tangem bought from the same shop safe? Bitcoin Malaya asked exactly that. As of October 10 — no answer.

My take: the weakest link was never the cryptography

Here's the thing the crypto industry keeps refusing to learn. Ledger's cryptography is fine. Its firmware is fine. The mathematics protecting your keys have never been the problem — the problem is the cardboard box, the reseller's back room, the shipping label, the store counter. Every spectacular Ledger failure in the last six years has been an attack on the edges of the system: the marketing database, the NPM account, the App Store listing, and now the physical supply chain. Security people have a phrase for this — attackers go around the wall, not through it — and Ledger keeps proving them right in increasingly expensive ways.

The "buy from an authorized reseller" defence was always shoddier than it sounded. It assumed the threat was a fake listing, when the real threat is a middleman with a soldering iron. CryptoBilis may turn out to be entirely innocent — tampering could have happened anywhere between the factory and the store shelf, and the company's silence so far isn't evidence of anything. But innocence wouldn't change the lesson. A hardware wallet is only as trustworthy as every pair of hands that touched it, and this week we learned that chain can include one pair too many, even inside the approved channel.

Until the investigation lands, the honest position is Ledger's own: one confirmed implant, an unknown number of compromised devices, and losses that could be anywhere from $70 million to nothing we've properly counted. That's not comforting. It's just the truth.

Sources

This article drew on The Verge ("Ledger wallet tampering suspected after reports of crypto thefts"), CoinDesk, The Block, and Gizmodo's reporting of October 9–10, 2026; Ledger's official @Ledger_Support X posts of October 9 and October 10, 2026 (including the "Situation Update"); statements attributed to Binance co-founder CZ and AnchorWatch CEO Rob Hamilton via The Block and Gizmodo; the Karpelès X teardown thread as relayed by Gizmodo; and the Tangem blog's account of the August 2025 Thailand Nano X teardown. Loss figures are on-chain estimates from Specter, tanuki42, Arkham Intelligence, Bitquery, and Yfarmx — none independently verified by Ledger.

Related TechPulse USA coverage: the FBI confirmed a ShinyHunters hack earlier this year, hackers used Claude to break into corporate systems, and AI agents tried to hack Canada's government networks.

By Daniel Rao, Senior Technology Correspondent. Daniel covers cybersecurity and crypto infrastructure for TechPulse USA. He once lost a hardware wallet on a train in Berlin and has been paranoid about supply chains ever since.

Update, Oct. 11: how the drain unfolded

The forensics are getting sharper. Bitquery's reconstruction of the wallet drains shows the attackers were staging this well in advance: 41 small test transactions ran across Tron and Ethereum in the two weeks before the main event, then 25 Tron wallets authorized the same spender within three seconds and 111 Bitcoin wallets were emptied within a single block — the pattern of centralized control over compromised keys, not victims approving bad transactions one by one. Separately, Karpelès has now said his spy-implanted Ledger came from Malaysia with 'flawless shrink wrap,' the implant 'cleverly hidden where the screen's padding is supposed to be' — 'Even opening it, at first you don't see the implant.' And CryptoBilis has halted all hardware-wallet sales until the investigation concludes. One honest caveat stands: Ledger has still not verified the $93M loss figure, and one confirmed implant does not prove it caused every drained wallet. The hardware-attack theme runs through our other coverage: we reported how hardware implants beat firmware checks in Ukraine's data-centre attacks, and separately on AI agents attacking real systems as a different kind of intrusion.