# Ledger Spy Chip Implant: What Ledger Confirmed and What to Do
> Ledger confirmed a hardware implant in a CryptoBilis-sold device on Oct. 10, 2026. How it steals seed phrases, where sales stopped and what Ledger advises.
Ledger confirmed on Oct. 10, 2026 that "one of the impacted users' devices contained an unauthorized hardware implant," and on Oct. 13 its Donjon security lab said the implant reads the 24-word recovery phrase off the screen during setup and sends it out over LTE through an eSIM. Every fund loss Ledger has confirmed involves devices sold through CryptoBilis, a reseller in Southeast Asia; Ledger has not confirmed a total amount stolen.
**TL;DR**
- In seven X posts from Oct. 9 to Oct. 13, Ledger, its support account and CEO Pascal Gauthier moved from "investigating reports of loss of funds" to a confirmed implant, a technical description, and a request that sellers in seven Asian markets suspend sales.
- Ledger says the implant is a separate component that does not modify the Secure Element or Ledger's operating system and does not alter transactions or signatures. Ledger has not named the affected models.
- Loss figures come from third parties: Specter estimated more than $86 million (per Decrypt) and Bitquery counts $102.0 million from 324 wallets. Ledger has not confirmed the number of affected users or the total value lost.
## What did Ledger confirm, and when?
| Date (2026) | Account | What the post says |
|---|---|---|
| Oct. 9 | Ledger Support | Investigating reports of fund losses among Southeast Asian buyers of a reseller named CryptoBilis; asked CryptoBilis to pause all sales and shipments of Ledger devices |
| Oct. 10 | Ledger Support | Confirms an unauthorized hardware implant in one impacted user's device; CryptoBilis has stopped selling all hardware wallet inventory; Ledger is working with authorities |
| Oct. 11 | Ledger | "The volume of impacted devices is limited"; all confirmed cases tied to the Oct. 9 draining involve devices sold through CryptoBilis; Ledger's own systems and direct sales channels unaffected |
| Oct. 13 | Ledger (Donjon) | Explains how the implant captures the recovery phrase; Ledger is reviewing reports of implants in other signers and locations |
| Oct. 13 | Ledger | MediaMarkt Saturn has stopped selling Ledger devices in stores and online, "with Ledger's alignment," after one customer in Germany reported an implant; no loss of funds reported in that case |
| Oct. 13 | Ledger | Resellers and distributors in Hong Kong, Indonesia, Malaysia, the Philippines, Singapore, Thailand and Vietnam asked to stop sales and take products off shelves |
How Ledger's public account of the incident developed over five days. Source: Ledger and Ledger Support posts on X, Oct. 9-13, 2026.
In the last of these posts, Ledger said the only confirmed incidents remain in Southeast Asia and it has not verified a drain tied to a device bought elsewhere. Gauthier wrote the same day that the investigation is still working out who tampered with the devices and at which point in the distribution chain.
## How does the implant work, according to Ledger's Donjon?
The implant sits inside the device's case and watches the screen. A new device shows its 24-word recovery phrase during setup; when the implant recognizes those screens, a microcontroller decodes the words and an LTE connection, using a provisioned eSIM, transmits them. Whoever holds the 24 words can rebuild the wallet on another device.
Ledger said the implant is a separate component that does not modify the Secure Element (the chip that holds the keys) or the Ledger operating system, and does not alter transactions or signatures.
The attack path as Ledger describes it, and the parts Ledger says the implant does not modify or alter. Source: Ledger Donjon update posted by Ledger on X, Oct. 13, 2026.
BleepingComputer reports that former Mt. Gox CEO Mark Karpelès found the extra hardware behind the screen of a Ledger Nano X shipped from Malaysia, and that Tibane Labs found two implant versions in units bought via Amazon Japan and Yahoo! Auctions Japan: one that swapped in a smaller battery to make room, and one that fit where foam padding normally sits beneath the display.
## What does Ledger tell owners to do?
From the Oct. 13 Donjon post:
| Your situation | What Ledger says to do |
|---|---|
| Bought from CryptoBilis, not set up yet | Do not set it up; contact Ledger Support |
| Bought from CryptoBilis, already set up | Move assets promptly to a new signer with a new recovery phrase; never enter or restore any recovery phrase on the CryptoBilis device |
| Lost funds, or holding a tampered signer | Contact Ledger Support at support.ledger.com and report to local law enforcement; do not send the device to anyone first; if funds were lost, coordinate with police before opening it |
| Did not buy from CryptoBilis but want to check | Ledger points to an inspection guide on its support site and warns to back up the recovery phrase first, because opening a signer can damage it |
The Oct. 9 post aimed its advice at people who bought from CryptoBilis "in the last 90 days." The Oct. 10, 11 and 13 posts give the advice to CryptoBilis buyers with no time window. Bitquery, which traced the drained wallets on-chain, reports that of the TRON, Bitcoin and Ethereum victim wallets it checked, 6 in 10 were first funded inside that 90-day window and more than 8 in 10 from June onward; Bitquery notes a wallet's first funding does not prove when the device was bought.
Ledger's Oct. 11 and Oct. 13 posts also say Ledger will never call users, message them directly or ask for the 24-word recovery phrase.
## Can Ledger's Genuine Check detect the implant?
The published accounts say a tampered device can pass it. Help Net Security reports Karpelès's account that his tampered device arrived shrink-wrapped and passed Genuine Check because its security chip is real. The Record reports that Ledger warned tampered devices may still pass its authenticity checks, since the implant leaves the Secure Element intact.
## How much was stolen?
Ledger has not said. Its Oct. 13 post says figures circulating online "come from third parties and Ledger has not fully verified them."
| Source | Figure | Notes |
|---|---|---|
| Ledger | Not confirmed | Total users and value lost not confirmed as of Oct. 13 |
| Specter (on-chain investigator) | More than $86 million | As reported by Decrypt |
| Bitquery | $102.0 million from 324 wallets | Six chains, valued at Oct. 9 prices; figures verified Oct. 13 |
Loss figures by source; Ledger says figures circulating online come from third parties and it has not fully verified them. Source: Ledger (Oct. 13, 2026); Bitquery (verified Oct. 13); Decrypt (Oct. 14).
Bitquery says its total runs higher because it includes drains on Solana, BNB Chain and Polygon, plus six TRON addresses the thief used that no public list had. It also reports that Tether froze $10.0 million.
## Background: the reseller link
Ledger's Oct. 11 post reminded its authorized resellers and distributors to source stock only through authorized channels and never to restock returned products. Bitquery says CryptoBilis was listed as an authorized seller; CoinDesk reports it operates in Indonesia, Malaysia and the Philippines. On its website, according to The Record, CryptoBilis said it has paused Ledger sales and shipments and is "cooperating fully" with Ledger's investigation.
The Block reports that Trezor dropped CryptoBilis from its reseller list as a precaution and will end some reseller authorizations on Jan. 1, 2027, and that OneKey revoked CryptoBilis's authorization and is offering free replacements for OneKey devices bought through it between March 1 and Oct. 13. The Block also reports Karpelès's claim that a Ledger Flex bought at Singapore's airport held an implant; Ledger has not confirmed a link to the CryptoBilis case.
As of 11:50 a.m. ET on Oct. 14, SignalStack found no statement from a named police agency and no court filing in the case; Ledger says it is working with "relevant authorities" without naming them. Related: the [Brevo supply-chain attack](/blog/brevo-supply-chain-attack-cloudflare-api-key/), the [Axios npm incident](/blog/axios-npm-supply-chain-attack-deploys-sophisticated-remote-access-trojan/), our [supply-chain attack glossary entry](/glossary/software-supply-chain-attack/) and [Tech & Security](/category/tech-security/).
## What could go right
- Ledger says the Donjon will analyze the signers it receives and share more; Gauthier says the investigation aims to establish who tampered with the devices and where.
- Ledger says it is reviewing reseller controls and anti-tamper protections, and has asked researchers and other vendors to work with it on chain-of-custody practices.
## What could go wrong
- Ledger has not named the affected models, the total loss, or where the tampering happened.
- Ledger is reviewing reports of implants in other signers and locations, and MediaMarkt Saturn's halt followed an implant report from Germany.
- Per The Record, a tampered device may pass the authenticity check. Karpelès says, per Help Net Security, that the only reliable way to find the extra board is to open the device; Ledger, pointing to its inspection guide, warns that opening a signer can damage it.
## FAQ
Q Did Ledger confirm a spy chip in its hardware wallets?
A Yes. On Oct. 10, 2026, Ledger Support said one impacted user's device contained an unauthorized hardware implant. All confirmed fund losses involve devices sold through the Southeast Asian reseller CryptoBilis.
Q How does the Ledger implant steal the seed phrase?
A Per Ledger's Donjon (Oct. 13), it reads the screen from inside the case and, when the 24-word phrase appears during setup, decodes it and sends it over LTE via an eSIM.
Q What should I do if I bought a Ledger from CryptoBilis?
A Ledger says not to set up an unused device and to contact Ledger Support. If it is already set up, Ledger says to move assets promptly to a new signer with a new recovery phrase.
Q How much crypto was stolen in the Ledger CryptoBilis hack?
A Ledger has not confirmed a total. Bitquery counts $102.0 million from 324 wallets; Specter estimated more than $86 million (per Decrypt).
Q Where has Ledger asked sellers to stop selling its devices?
A On Oct. 13, 2026, Ledger asked sellers in Hong Kong, Indonesia, Malaysia, the Philippines, Singapore, Thailand and Vietnam to halt sales. Ledger said that day that MediaMarkt Saturn had stopped selling Ledger devices "with Ledger's alignment"; The Block described it as a halt to European sales.
