Ledger Spy Chips Stole Recovery Phrases and $86 Million in Crypto

Ledger says a Ledger spy chip hidden inside hardware wallets sold by one Southeast Asian reseller read users' 24-word recovery phrases off the screen and sent them over a mobile network, helping thieves drain crypto wallets. Estimated losses run from about $86 million to more than $100 million, and Ledger has not confirmed a final figure. The company is Paris-based and the tampered devices moved through a Southeast Asian channel, but American buyers of hardware wallets face the same physical risk.

How the Ledger spy chip captured recovery phrases

Recovery phrases matter because they are the master key. A hardware wallet stores the private keys that control a user's crypto and signs transactions, and the 24-word phrase can rebuild those keys on another compatible device. Anyone who holds the phrase can move the funds without ever touching the original hardware, as BleepingComputer explained in its coverage.

The route is what makes this case unusual. In its October 13 investigation update, Ledger said the implant sat inside the device enclosure, read the recovery phrase as it appeared on screen during setup, and sent it out over LTE using an embedded eSIM, according to CoinDesk. A cellular connection means the implant did not need a victim's Wi-Fi network or a computer to leave the device. Physical supply-chain attacks have hit networking gear and point-of-sale systems before, but a cellular modem reading a screen is a notably different method.

Ledger has described the thefts as a physical supply-chain attack, not a breach of its software or internal systems. That distinction matters for owners. The problem sits in hardware that passed through a reseller's hands, not in the firmware Ledger ships directly.

What Ledger found inside CryptoBilis devices

Ledger opened an investigation on October 9 after users reported losses tied to wallets bought through CryptoBilis. The company asked the reseller to stop selling and shipping Ledger devices. The next day, Ledger confirmed a hardware implant in at least one user's device. In a statement quoted by BleepingComputer, the company said: "Ledger can confirm that one of the impacted users' devices contained an unauthorized hardware implant."

CryptoBilis is the reseller at the center of the case. One Slashdot summary describes it as a Malaysia-based hardware wallet retailer operating across Southeast Asia. The reporting does not say how many units it sold or how many of them were tampered with.

Timeline of the Ledger spy chip case

The discount is part of the trap. Researchers said tampered devices were sold at nearly half their original price, and a steep markdown is exactly what makes a bad unit look like a bargain.

How much crypto was taken, and what is still disputed

Loss estimates differ by source and method. Bitbo reported more than $86 million drained from hundreds of wallets on October 12. Bloomberg, as reported by Quartz, put the figure at about $90 million two days later. A separate set of independent onchain estimates, summarized by Ground News, reaches $93.2 million to $103.4 million across multiple blockchains. Ledger has not confirmed total losses or the number of affected customers.

A separate theft complicates the picture. According to KuCoin News, a task-scam operator lost more than 60 BTC, roughly $4.8 million to $4.9 million, when three Ledger addresses were emptied on October 9. Some outlets tie that theft to the implants, while others say the cause is unproven. Until Ledger or investigators confirm a link, that loss should be tracked apart from the spy chip totals.

Which resellers and regions are under scrutiny

Ledger has directed resellers across Southeast Asia and Hong Kong to halt device sales while the investigation continues, according to Bloomberg as reported by Quartz. The company also says it is reviewing its reseller controls and anti-tampering protections, according to Yahoo Finance and Quartz.

The footprint may be wider than one reseller. Researcher Mark Karpelès reported that similar implants turned up in Ledger devices sold through two additional authorized resellers, which suggests possible mass production rather than isolated tampering. The reporting I reviewed does not show Ledger confirming that finding. It also does not say where the devices were tampered with, or by whom.

The U.S. angle is indirect so far. The sources do not say how many American buyers received affected units, whether U.S. retail channels were involved, or whether the FBI or another U.S. agency has issued an advisory. Those gaps matter because a finding outside Southeast Asia would change how American owners should think about their own devices.

What to do if you bought a Ledger from a reseller

Owners should act now, especially if a device came from a reseller they cannot verify.

• Check the source. Confirm where the device was bought, and treat a unit from a third-party reseller, especially one not on the manufacturer's list, as suspect.
• Do not initialize an unused device from CryptoBilis. Ledger has advised customers not to set up unused devices from the reseller.
• Move funds if you already set one up. Ledger's guidance is to move assets to a new device with a freshly generated recovery phrase.
• Never type your recovery phrase into a website, app or "firmware update" prompt.
• Look for signs of tampering, such as unexpected battery or board changes. Researchers say the implant was designed to avoid obvious external signs, so a clean-looking device is not proof of safety.
• Buy directly from the manufacturer or an authorized channel. Hardware-wallet makers generally recommend this, because tampered units were sold at discounts.

Phishing is the second threat. SlowMist warned on October 16 about phishing campaigns posing as firmware updates that exploit the incident. No legitimate firmware update should ask for your 24-word recovery phrase, so treat any prompt that does as a sign of theft.

What comes next for Ledger owners

Several answers will shape how serious this becomes. The first is whether Ledger publishes a full account of where and when the tampering happened. The second is whether the implant turns up in devices sold outside Southeast Asia, including the United States.

Ledger's reseller pause could stay in place or become permanent, and that decision would change how the company sells hardware. Ledger will also need to confirm a total loss figure to close the gap between $86 million and more than $100 million. Watch for a confirmed link, or a clear rejection of one, between the spy chip and the $4.8 million task-scam theft. Any U.S. law enforcement action would also signal how far the case reaches. Until those answers arrive, the safest assumption for any owner is that a device is only as trustworthy as its chain of custody.