A Spy Chip Was Soldered Into Ledger Wallets. Researchers Put the Loss at $86 Million.

Ledger has confirmed that one of the hardware wallets behind a wave of drained crypto accounts held an extra chip that nobody put there. On October 10 the company said "one of the impacted users' devices contained an unauthorized hardware implant" 1. The wallets involved were sold by CryptoBilis, a reseller that Ledger lists for Indonesia, Malaysia and the Philippines 2.

It started on October 9, when Ledger said it was investigating lost funds reported by users in Southeast Asia and asked CryptoBilis to pause all sales and shipments of its devices, telling anyone who had bought there in the previous 90 days not to set an unused wallet up. People who had already set one up were told to move their assets to a new device with a new seed 3. On October 11 the company said that every confirmed case involves CryptoBilis, that its own systems and direct sales were untouched, and that it is working with authorities; it also told its distributors not to restock returned products 4.

The money is the part Ledger has not put a number on. On-chain researchers have estimated the loss at between $86 million and $93 million from more than 300 wallets, across Bitcoin, Ethereum and Tron 1. The first figure came from the pseudonymous investigator Specter, who traced suspect addresses across the three chains after users posted about drained accounts on X and Reddit; a second analyst, tanuki42, published receiving addresses and put an early running total above $72 million 25. Ledger has confirmed no loss figure of its own, and whether every drained wallet came through the same reseller is still unestablished.

The clearest account of the hardware comes from Tibane Labs, which obtained two tampered Ledger Nano X units and tore them down. A wallet keeps its key inside a hardened secure element, but it still has to show the owner 24 recovery words once, at setup, and to show them it has to send them to the screen. The implant waits on that path: it is a second, tiny computer soldered onto the board and wired to the display's data lines — the OLED SPI bus — where it watches the pixels go past, matches the letters of each word, stores them, and sends them out over its own cellular modem, SIM and antenna. It never attacks the secure element, and the wallet behaves normally 6.

That is what defeats the obvious defence. Ledger's own hardware-integrity page describes the Genuine Check every device passes on setup and on every connection — cryptographic proof that the secure element is real, which "even perfect-looking packaging or branding can't fake" — and then states its limit: it cannot detect unauthorised physical modification "if the original Secure Element remains intact" 7.

Tibane Labs traces three generations. The first was a prototype found in August 2025, a bundle of enamelled copper wire running from the display's data lines to an add-on board, reverse-engineered by Joe Grand and presented at hardwear.io USA 2026. The second, bought on Yahoo! Auctions in Japan, replaces the wires with a Kapton flex circuit soldered onto the wallet's own factory test pads. The third, bought on Amazon Japan from a third-party seller and shipped from Malaysia, hides beneath the screen with its chip markings sanded off, its board painted to match, and the original battery left in place. The page notes that the two specimens it examined were bought on ordinary resale channels and are not proven to be the units sold by CryptoBilis 6. The Verge reported photos of a small circuit board sandwiched under the screen, sending what it read over an embedded SIM 8.

Nobody has publicly named who built the implants. CryptoBilis has not commented on the incident 1. The former co-founders of CryptoBilis told Tibane Labs the business changed hands in March 2026 and that they lost access to its systems then — the page reports that without establishing what followed 6. Binance co-founder Changpeng Zhao posted on X that the attackers "apparently bought the reseller and made them sign a non-disclosure agreement to keep their mouth shut"; CoinDesk reports the claim as unverified 1. No arrests, charges or penalties have been reported.

Hardware wallets had already been shown to be beatable this year. In July 2026 a flaw in Coldcard's seed-generation firmware let attackers drain an estimated $100 million to $130 million in bitcoin 1. Ledger, founded in Paris in 2014, says it has sold more than seven million devices 5.

If you bought a Ledger through CryptoBilis, the company's guidance is the same as it was on day one: do not initialise an unused device, and if yours is already running, move to a new seed on a device obtained from Ledger. Ledger says it will never call, message or ask for your 24 words 1. The company's own tampering page has long recommended buying direct or through its authorised retail network 7.

"Not Your Keys" is an original rap song and music video built from those facts.