Ledger Spy Chip Implant: What Ledger Confirmed and What to Do

Ledger confirmed on Oct. 10, 2026 that “one of the impacted users’ devices contained an unauthorized hardware implant,” and on Oct. 13 its Donjon security lab said the implant reads the 24-word recovery phrase off the screen during setup and sends it out over LTE through an eSIM. Every fund loss Ledger has confirmed involves devices sold through CryptoBilis, a reseller in Southeast Asia; Ledger has not confirmed a total amount stolen.

TL;DR

• In seven X posts from Oct. 9 to Oct. 13, Ledger, its support account and CEO Pascal Gauthier moved from “investigating reports of loss of funds” to a confirmed implant, a technical description, and a request that sellers in seven Asian markets suspend sales.
• Ledger says the implant is a separate component that does not modify the Secure Element or Ledger’s operating system and does not alter transactions or signatures. Ledger has not named the affected models.
• Loss figures come from third parties: Specter estimated more than $86 million (per Decrypt) and Bitquery counts $102.0 million from 324 wallets. Ledger has not confirmed the number of affected users or the total value lost.

What did Ledger confirm, and when?

Date (2026)	Account	What the post says
Oct. 9	Ledger Support	Investigating reports of fund losses among Southeast Asian buyers of a reseller named CryptoBilis; asked CryptoBilis to pause all sales and shipments of Ledger devices
Oct. 10	Ledger Support	Confirms an unauthorized hardware implant in one impacted user’s device; CryptoBilis has stopped selling all hardware wallet inventory; Ledger is working with authorities
Oct. 11	Ledger	”The volume of impacted devices is limited”; all confirmed cases tied to the Oct. 9 draining involve devices sold through CryptoBilis; Ledger’s own systems and direct sales channels unaffected
Oct. 13	Ledger (Donjon)	Explains how the implant captures the recovery phrase; Ledger is reviewing reports of implants in other signers and locations
Oct. 13	Ledger	MediaMarkt Saturn has stopped selling Ledger devices in stores and online, “with Ledger’s alignment,” after one customer in Germany reported an implant; no loss of funds reported in that case
Oct. 13	Ledger	Resellers and distributors in Hong Kong, Indonesia, Malaysia, the Philippines, Singapore, Thailand and Vietnam asked to stop sales and take products off shelves

In the last of these posts, Ledger said the only confirmed incidents remain in Southeast Asia and it has not verified a drain tied to a device bought elsewhere. Gauthier wrote the same day that the investigation is still working out who tampered with the devices and at which point in the distribution chain.

How does the implant work, according to Ledger’s Donjon?

The implant sits inside the device’s case and watches the screen. A new device shows its 24-word recovery phrase during setup; when the implant recognizes those screens, a microcontroller decodes the words and an LTE connection, using a provisioned eSIM, transmits them. Whoever holds the 24 words can rebuild the wallet on another device.

Ledger said the implant is a separate component that does not modify the Secure Element (the chip that holds the keys) or the Ledger operating system, and does not alter transactions or signatures.

BleepingComputer reports that former Mt. Gox CEO Mark Karpelès found the extra hardware behind the screen of a Ledger Nano X shipped from Malaysia, and that Tibane Labs found two implant versions in units bought via Amazon Japan and Yahoo! Auctions Japan: one that swapped in a smaller battery to make room, and one that fit where foam padding normally sits beneath the display.

What does Ledger tell owners to do?

From the Oct. 13 Donjon post:

Your situation	What Ledger says to do
Bought from CryptoBilis, not set up yet	Do not set it up; contact Ledger Support
Bought from CryptoBilis, already set up	Move assets promptly to a new signer with a new recovery phrase; never enter or restore any recovery phrase on the CryptoBilis device
Lost funds, or holding a tampered signer	Contact Ledger Support at support.ledger.com and report to local law enforcement; do not send the device to anyone first; if funds were lost, coordinate with police before opening it
Did not buy from CryptoBilis but want to check	Ledger points to an inspection guide on its support site and warns to back up the recovery phrase first, because opening a signer can damage it

The Oct. 9 post aimed its advice at people who bought from CryptoBilis “in the last 90 days.” The Oct. 10, 11 and 13 posts give the advice to CryptoBilis buyers with no time window. Bitquery, which traced the drained wallets on-chain, reports that of the TRON, Bitcoin and Ethereum victim wallets it checked, 6 in 10 were first funded inside that 90-day window and more than 8 in 10 from June onward; Bitquery notes a wallet’s first funding does not prove when the device was bought.

Ledger’s Oct. 11 and Oct. 13 posts also say Ledger will never call users, message them directly or ask for the 24-word recovery phrase.

Can Ledger’s Genuine Check detect the implant?

The published accounts say a tampered device can pass it. Help Net Security reports Karpelès’s account that his tampered device arrived shrink-wrapped and passed Genuine Check because its security chip is real. The Record reports that Ledger warned tampered devices may still pass its authenticity checks, since the implant leaves the Secure Element intact.

How much was stolen?

Ledger has not said. Its Oct. 13 post says figures circulating online “come from third parties and Ledger has not fully verified them.”

Source	Figure	Notes
Ledger	Not confirmed	Total users and value lost not confirmed as of Oct. 13
Specter (on-chain investigator)	More than $86 million	As reported by Decrypt
Bitquery	$102.0 million from 324 wallets	Six chains, valued at Oct. 9 prices; figures verified Oct. 13

Bitquery says its total runs higher because it includes drains on Solana, BNB Chain and Polygon, plus six TRON addresses the thief used that no public list had. It also reports that Tether froze $10.0 million.

Background: the reseller link

Ledger’s Oct. 11 post reminded its authorized resellers and distributors to source stock only through authorized channels and never to restock returned products. Bitquery says CryptoBilis was listed as an authorized seller; CoinDesk reports it operates in Indonesia, Malaysia and the Philippines. On its website, according to The Record, CryptoBilis said it has paused Ledger sales and shipments and is “cooperating fully” with Ledger’s investigation.

The Block reports that Trezor dropped CryptoBilis from its reseller list as a precaution and will end some reseller authorizations on Jan. 1, 2027, and that OneKey revoked CryptoBilis’s authorization and is offering free replacements for OneKey devices bought through it between March 1 and Oct. 13. The Block also reports Karpelès’s claim that a Ledger Flex bought at Singapore’s airport held an implant; Ledger has not confirmed a link to the CryptoBilis case.

As of 11:50 a.m. ET on Oct. 14, SignalStack found no statement from a named police agency and no court filing in the case; Ledger says it is working with “relevant authorities” without naming them. Related: the Brevo supply-chain attack, the Axios npm incident, our supply-chain attack glossary entry and Tech & Security.

What could go right

• Ledger says the Donjon will analyze the signers it receives and share more; Gauthier says the investigation aims to establish who tampered with the devices and where.
• Ledger says it is reviewing reseller controls and anti-tamper protections, and has asked researchers and other vendors to work with it on chain-of-custody practices.

What could go wrong

• Ledger has not named the affected models, the total loss, or where the tampering happened.
• Ledger is reviewing reports of implants in other signers and locations, and MediaMarkt Saturn’s halt followed an implant report from Germany.
• Per The Record, a tampered device may pass the authenticity check. Karpelès says, per Help Net Security, that the only reliable way to find the extra board is to open the device; Ledger, pointing to its inspection guide, warns that opening a signer can damage it.

FAQ

Q Did Ledger confirm a spy chip in its hardware wallets?

A Yes. On Oct. 10, 2026, Ledger Support said one impacted user's device contained an unauthorized hardware implant. All confirmed fund losses involve devices sold through the Southeast Asian reseller CryptoBilis.

Q How does the Ledger implant steal the seed phrase?

A Per Ledger's Donjon (Oct. 13), it reads the screen from inside the case and, when the 24-word phrase appears during setup, decodes it and sends it over LTE via an eSIM.

Q What should I do if I bought a Ledger from CryptoBilis?

A Ledger says not to set up an unused device and to contact Ledger Support. If it is already set up, Ledger says to move assets promptly to a new signer with a new recovery phrase.

Q How much crypto was stolen in the Ledger CryptoBilis hack?

A Ledger has not confirmed a total. Bitquery counts $102.0 million from 324 wallets; Specter estimated more than $86 million (per Decrypt).

Q Where has Ledger asked sellers to stop selling its devices?

A On Oct. 13, 2026, Ledger asked sellers in Hong Kong, Indonesia, Malaysia, the Philippines, Singapore, Thailand and Vietnam to halt sales. Ledger said that day that MediaMarkt Saturn had stopped selling Ledger devices "with Ledger's alignment"; The Block described it as a halt to European sales.