Ledger Wallet Hidden Spy Chip

Crypto worth more than 86 million dollars was drained from Ledger wallets. Each confirmed case was a wallet bought from a shop Ledger had authorized itself. Inside one of them sat a second circuit board.

On October 9, an on-chain investigator who goes by Specter posted a list of ten crypto addresses on X. Ledger users had been reporting empty wallets online, and he followed the stolen funds on Bitcoin, Ethereum and TRON back to where they came from. Money had flowed in from victim wallets, and his count came to more than 86 million dollars. How many wallets that was, he wrote later that day, he could not tell yet.

About an hour later, Ledger posted that it was looking into losses among users in Southeast Asia who had bought their Ledger from one reseller, CryptoBilis. It had asked CryptoBilis to stop selling and shipping Ledger devices. Buyers from the last 90 days were told not to set their device up, and buyers who already had were advised to move their crypto to a new Ledger with a new recovery phrase.

The next day, Ledger wrote: “Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant.” From then on, its advice covered buyers from CryptoBilis whenever they had bought: do not set the device up.

CryptoBilis, an authorized Ledger reseller in Malaysia, Indonesia and the Philippines, stopped selling hardware wallets. On October 11, Ledger said the number of affected devices is limited, and that each confirmed case so far is a device sold through CryptoBilis. How much was stolen, Ledger has not confirmed.

A hardware wallet stores the key to your crypto inside a special chip, the secure element, made to resist people who try to pull secrets out of it with lab equipment. When you set the wallet up, it shows you 24 recovery words one time, so you can write them down. With those words, the wallet and the crypto in it can be rebuilt on another device. To show them, the secure element sends them to the small screen. On a Nano X that goes over three thin wires, a connection called the SPI bus, as plain data without any encryption.

Researchers at Tibane Labs tapped those wires on a Nano X themselves while it started up. From the data they caught, they rebuilt the screen exactly as it was drawn, down to the Ledger logo 734.6 milliseconds in. The recovery words travel over the same wires.

The implant is connected to those three wires. It is a small extra board with its own processor, added to a wallet that came out of Ledger’s own factory. Its processor reads along with the screen, picks out the letters and keeps the words. A mobile modem on the same board, with its own SIM card and antenna, then sends them to the attacker. For the owner, nothing changes. The wallet works as it always did, and Ledger’s genuine check, the one that tells you the device is genuine, still passes, because the secure element did come from Ledger.

On October 13, Ledger’s own security lab, Ledger Donjon, described the implant in the CryptoBilis wallets the same way. It sits inside the case and reads what is shown on the screen. When the wallet displays the 24 recovery words during setup, its microcontroller, the small processor on the extra board, decodes them. It then sends them out over LTE, the 4G mobile network, through an eSIM, a SIM card built in as a chip. Ledger says it is a separate component that does not change the secure element, the operating system or the transactions.

The researchers who tapped the screen wires have followed this implant through three versions so far, and each one is harder to spot than the one before.

The first turned up in August 2025, in a Reddit thread warning about a “Nano X” sold to steal crypto. Joe Grand of Grand Idea Studio, a hardware hacker, got hold of that device, took it apart and showed what was inside at the hardwear.io USA 2026 conference. It was a prototype, with thin enamel-coated copper wires running from the screen lines to a small add-on board, glued in where part of the battery used to be. To make room, the battery had been shrunk to 70 mAh. A fixed 10 kΩ resistor replaced its temperature sensor, and the battery gauge was bypassed, so the wallet always showed a full battery. Its firmware held the shapes of the letters a to z, matched the screen data against them and stored the recovery words. The modem used an eSIM, and that eSIM carried a Vodafone NL “DATA ONLY” profile.

The first known implant that read the recovery words off a Ledger’s screen went out over a Dutch data SIM.

In September 2026 the researchers got hold of two newer ones. The first came from Yahoo! Auctions in Japan, and the loose wires were gone. In their place was a flat flex circuit, the kind you order from a board factory, laid across the back of the Ledger’s board. It was soldered onto the factory test pads, the small contact points a board gets tested on before it leaves the factory. Those pads gave the implant power from the wallet’s battery and a view of the data going to the screen, which means whoever made it had the test pad layout of the Nano X in hand. The battery was swapped for a smaller one again, this time with no markings and no protection circuit, so there was nothing to stop it from overcharging or shorting. The chip that runs this implant carries a date code that, in the chip maker’s usual format, reads as week 51 of 2025, months after that first warning.

The other one came from Amazon Japan, from a seller based in China, in a parcel shipped from Malaysia. Open the case with the screen still in place and it looks like an ordinary Nano X, with the original battery and the original board. The only thing out of place is a thin black antenna wire along the top edge. Under the screen sat the modem, a microcontroller and an eSIM. A foam pad normally cushions the back of the display, and the builders tore it out to make room, so the battery could stay as it was. They coated the implant board the same black as the Ledger’s own board, so it doesn’t stand out when the case is opened. They also scraped the tops of the microcontroller and the eSIM until the part numbers were gone.

The modem kept its markings. It is a Nordic nRF9151, an ordinary part sold for low power mobile networks. In its maker’s usual format, its date code reads as week 39 of 2025, so it is also newer than the first warning.

The antenna was made for the Nano X alone. It is a thin printed strip that follows the inside of the case, with its own part number printed on it: AC-A2016-NANO-V1.1. NANO is the target, and V1.1 means there was already a version before it. The implant board is cut around the Ledger’s own parts, so it drops straight into place without measuring and with hardly any skill, and the researchers describe it as built for mass installation.

Photos of an implant hidden under the screen were online before the drains. On September 16, three weeks before the first reports, Mark Karpelès, the former CEO of the Mt. Gox Bitcoin exchange, posted them. He had bought his Nano X outside Ledger’s recommended channels, on a well known platform, from a Chinese seller, at close to half the normal price, and it was shipped from Malaysia. “The new implant is hidden by the screen, so I would expect some people may miss it,” he wrote, and the easiest tell, according to him, is the antenna cable.

On October 13, he posted that a Ledger Flex, bought this summer at Singapore airport, also contained a spy implant. The buyer had seen scratches on the case, never plugged it in and sent it to him instead.

The reports now reach Europe too. On October 12, a user who goes by Johannes posted on X that he had bought a Ledger at two different MediaMarkt stores, and that both had extra cables and an LTE module inside. According to a store employee, he wrote, the second one was not a return. His post passed 1.5 million views. A day later, MediaMarktSaturn told Cointelegraph it has removed all of the manufacturer’s products from its stores and online platforms. On mediamarkt.nl, a search for Ledger no longer turns up a single Ledger wallet.

Ledger itself wrote on October 13 that MediaMarkt Saturn stopped selling Ledger devices with its agreement, after one customer in Germany reported an implant, and that no loss of funds was reported. It has not confirmed that implant or the one in the Flex. It says it has not verified a drain tied to a wallet bought outside CryptoBilis, and that it is reviewing reports of implants in other models and locations.

CryptoBilis changed hands this year. Its former co-founders told the researchers that new owners bought the company earlier in 2026, and that they have had no access to it since the handover. A post on X, citing screenshots from the company registry that the researchers have not verified, says it passed in August 2026 to a shareholder with an address in China. The second implant the researchers bought was shipped from Malaysia, where CryptoBilis is based. The researchers mention that, and in the same breath say they have no evidence linking the two. They have not tested a device sold by CryptoBilis, and a change of owners does not prove anything.

In cybersecurity, attribution is one of the hardest problems. Parts are sold openly, and a seller can sit in one country and ship from another. The researchers also point out that an implanted wallet doesn’t need the attacker to sell it, because ordinary resale moves it along. What we know for sure is how these implants work. Who put one in the wallet Ledger examined is still unknown, and Ledger says it is working with the authorities to find out.

Ledger also wrote that this threat reaches past Ledger to the rest of the industry. It asked others to work together on keeping track of devices from the factory to the buyer and on making tampering harder. Its own authorized resellers and distributors were told to buy stock only through authorized channels, and never to put returned products back on the shelf. A returned box has already been in someone else’s hands.

So the secure element did what Ledger built it for, and the key stayed inside the chip. The implant only needed the one moment the chip shows the 24 words to a person, and copied them on their way to the screen. The wires to the display and anything soldered next to them are outside the chip’s reach, and the genuine check only asks the chip whether the chip is genuine.

The implant gets its chance during setup, when the 24 words are on the screen. A wallet that has not been set up has not shown them yet. Once the words have been on the screen of a wallet like this, assume someone else has them too, even if the wallet never touched a computer. The only way out is a new recovery phrase, created on a device you trust, with your crypto moved over to it. Ledger now also says never to enter or restore a recovery phrase on a wallet bought from CryptoBilis.

What you can do:

• → Bought from CryptoBilis and not set up yet: don’t set it up, and contact Ledger Support
• → Already set up: move your crypto promptly to a new wallet with a new recovery phrase
• → Never enter or restore a recovery phrase on a wallet bought from CryptoBilis
• → Lost crypto or holding a tampered wallet: keep the device and its packaging, don’t reset it, file a police report, and talk to the police before you open it or send it off
• → Buy a hardware wallet from the maker itself, and walk away from one sold far below the normal price
• → Bought elsewhere and want to look inside: back up your 24 words first, because opening a wallet can damage it, and follow Ledger’s own inspection guide
• → Changpeng Zhao, the founder of Binance, advises leaving a new hardware wallet for a couple of weeks before you move a meaningful amount to it, and following the news in that time
• → Ledger will never call you, message you or ask for your 24 words, and scammers use incidents like this one to try
• → Information about the people behind this goes to security@ledger.com

Your other devices use your own network instead of a hidden SIM, and you can learn to read exactly what each of them sends. My Ethical Hacking Complete Course Zero to Expert takes you there step by step: reconnaissance, scanning, exploitation and traffic analysis, hands-on, from your first day with no Linux or hacking background.

→ Join my complete ethical hacking course

Hacking is not a hobby but a way of life.

Sources:

Ledger Donjon update | Ledger Support | Tibane Labs | Specter | Mark Karpelès