Ledger Discovers Hidden Spy Chip in Crypto Wallets as $93 Million Theft Investigation Expands

Ledger has revealed how a sophisticated hardware implant allegedly enabled attackers to steal cryptocurrency recovery phrases from devices sold through CryptoBilis, a Southeast Asian reseller. The discovery marks a significant development in an investigation into a series of wallet drains that blockchain analytics firms estimate could have resulted in more than $93 million in losses.

In an October 13 update, Ledger explained that its internal security research team, known as Ledger Donjon, identified an unauthorized electronic component concealed inside an affected hardware wallet. Rather than exploiting a conventional software vulnerability, the implant reportedly captured the device's 24-word recovery phrase during setup and transmitted it to attackers over a cellular connection.

The incident highlights a serious security concern for cryptocurrency holders: even when a hardware wallet's software and primary security chip remain uncompromised, unauthorized modifications to the physical device can undermine the protection it is designed to provide.

The investigation began after users reported unexpected cryptocurrency withdrawals involving Ledger devices purchased through CryptoBilis. Ledger subsequently confirmed that at least one affected device contained an unauthorized hardware implant and advised the reseller to suspend sales while the company investigated.

Ledger has since stated that all confirmed wallet-drain reports under investigation involve devices sold through CryptoBilis. The company has not confirmed the full number of affected users or the total value of cryptocurrency stolen, and it is also reviewing reports involving other devices and locations.

Blockchain analytics firms have provided estimates of the financial damage. Bitquery traced approximately $93.2 million in stolen cryptocurrency across 315 wallets and six blockchains, while another security research firm reported a higher estimate. These figures remain third-party estimates rather than a confirmed total from Ledger.

The scale of the incident has drawn attention throughout the cryptocurrency industry, particularly because hardware wallets are widely recommended as a way to reduce exposure to online attacks.

Ledger devices are designed to keep private keys isolated from internet-connected computers and phones. Users can approve transactions directly on the device without exposing their private keys to the connected computer. However, the CryptoBilis incident demonstrates how a compromised supply chain can introduce a separate risk that conventional software security measures may not prevent.

According to Ledger's investigation, the unauthorized implant was designed to recognize the recovery phrase displayed on the device's screen during initial setup. A microcontroller captured and decoded the displayed words, then used a provisioned embedded SIM, or eSIM, to transmit the information over an LTE cellular connection.

The recovery phrase is effectively the master key to a cryptocurrency wallet. Anyone who obtains it can restore the wallet on another compatible device or software application and access the funds associated with it. They do not need to possess the original hardware wallet or gain access to the owner's computer.

That distinction helps explain why the reported thefts were so damaging. Once attackers obtain a valid recovery phrase, the security of the original device is no longer enough to protect the wallet. The attackers can use the copied phrase to recreate the wallet and initiate transactions independently.

Ledger said the implant did not modify the device's Secure Element, the specialized chip designed to protect sensitive cryptographic operations. It also reportedly left the operating system unchanged and did not directly alter transaction signatures.

Instead, the attack appears to have operated outside the normal security mechanisms by observing information displayed during setup and transmitting it through a separate communications component. This is a physical supply-chain attack, rather than evidence that Ledger's core wallet software or internal systems were compromised.

That difference is important, but it does not make the incident less serious for affected customers. A device can retain its original security chip and software while still being dangerous if an attacker has added unauthorized hardware capable of capturing sensitive information.

The case also raises questions about how consumers can verify the integrity of hardware wallets purchased through third-party retailers. A device may look genuine, arrive in convincing packaging and function normally while containing components that were never installed or authorized by the manufacturer.

Ledger has urged customers who purchased devices through CryptoBilis not to initialize unused wallets. Customers who have already set up and used one of the affected devices should move their assets to a new wallet generated with a new recovery phrase. Simply transferring funds to another account controlled by the same compromised phrase would not solve the problem.

The company has also advised affected customers to contact Ledger support and coordinate with law enforcement before opening or shipping potentially compromised devices. Preserving evidence may be important to the investigation.

Meanwhile, the movement of the stolen cryptocurrency has created additional challenges for investigators. Blockchain transactions are publicly visible on many networks, allowing researchers to follow transfers between addresses. However, tracing funds does not automatically make them recoverable, particularly when assets move through multiple services or are converted into other forms.

One development in the recovery effort came from Tether, the issuer of USDT. Blockchain analytics reporting indicated that approximately $10 million in USDT connected to the incident had been frozen. Unlike Bitcoin, certain centrally issued stablecoins can be frozen by their issuer when addresses are identified as being associated with illicit activity.

The freeze could help investigators recover part of the reported losses, although it does not guarantee that the remaining funds can be returned to victims.

The investigation has also raised questions about whether attackers deliberately targeted the reseller's distribution channel. Ledger had listed CryptoBilis among its authorized resellers, making the incident particularly concerning for customers who believed they were purchasing through a recognized sales channel.

CZ, the former Binance chief executive, has also commented on the incident, alleging that hackers bought CryptoBilis as part of the operation. That allegation has added another layer to the discussion surrounding the reseller and the possible methods used to compromise devices. However, the claim should be treated as an allegation rather than an established finding, and the available reporting does not conclusively establish who controlled the reseller or how the malicious components were introduced.

CryptoBilis has paused sales and shipments while the investigation proceeds. Other hardware wallet manufacturers have also responded by reviewing their reseller relationships and distribution practices, reflecting broader concerns about the risks associated with unauthorized modifications and compromised inventory.

For the wider cryptocurrency industry, the incident is a reminder that security cannot stop at the software layer. Hardware manufacturers must account for the possibility of tampering during manufacturing, shipping, warehousing, retail distribution and product returns. Retailers, meanwhile, need reliable procedures for verifying inventory and ensuring that returned devices are not inadvertently resold after being modified.

Consumers also have a role to play. Purchasing hardware wallets directly from the manufacturer or through clearly authorized retailers can reduce exposure to questionable inventory, although it cannot eliminate every conceivable supply-chain risk. Buyers should be wary of unusually discounted devices, unfamiliar sellers and products that arrive with a recovery phrase already printed or written down.

A recovery phrase should be generated by the device during the user's own setup process and recorded privately by the owner. It should never be supplied by a seller, shared with customer support or entered into an unfamiliar website. Anyone who has seen the phrase may be able to access the associated funds.

It is also important to understand the limits of authenticity checks. Ledger's standard verification mechanisms can help establish whether a device's software and recognized components pass expected checks, but they are not necessarily capable of detecting every unauthorized physical modification. In this case, the implant reportedly left the Secure Element intact, meaning a conventional authenticity check might not identify the added hardware.

The incident does not establish that every Ledger wallet is compromised, nor does it demonstrate that all hardware wallets are unsafe. Confirmed cases have so far been linked to devices sold through CryptoBilis, while reports of possible implants elsewhere remain under investigation. Users should follow official manufacturer guidance rather than assume that a wallet purchased through an unrelated channel is affected.

Nevertheless, the case underscores an important principle for anyone holding cryptocurrency: self-custody transfers responsibility for protecting access to funds to the wallet owner, but that responsibility depends on the integrity of the tools being used.

As the investigation continues, Ledger faces the task of determining how the unauthorized components entered the supply chain, identifying the extent of the affected inventory and helping customers respond safely. Investigators will also need to establish who carried out the operation, how the stolen funds were moved and whether additional devices were compromised.

For cryptocurrency holders, the central lesson is clear. Hardware wallets remain an important security tool, but their protection depends on more than the device's software and security chip. Trusted sourcing, secure setup practices and careful handling of recovery phrases are all essential parts of keeping digital assets safe.