DeFi Market
The Ledger spy implant has been confirmed in at least one device, and so far the drained wallets trace back to one reseller in Southeast Asia, CryptoBilis. Ledger says its own systems weren't breached. If you bought straight from Ledger, nothing reported so far points at you. If you bought from a reseller, a marketplace, a secondhand seller or you don't know where it came from, the fix is to make a new 24-word recovery phrase on a device bought direct and move your funds to it. Never type your old phrase anywhere to do it.
Updated 14 October 2026. This story is still moving. Ledger hasn't published a count of affected devices or a loss total, and we'll update this page when it does.
What happened with the Ledger implant, and when
Someone opened Ledger wallets, fitted an extra part inside the case, sealed them back up and let them go out to buyers. The first sign was money vanishing from wallets in Southeast Asia. Within four days Ledger had found the part, a big European retailer had pulled stock, and Ledger had asked sellers in seven markets to take devices off the shelves.
| Date (2026) | What happened | Source |
|---|---|---|
| 9 Oct | Ledger says it's investigating fund losses among people who bought from CryptoBilis, an official reseller in Indonesia, Malaysia and the Philippines. It asks CryptoBilis to pause sales and tells buyers from the last 90 days not to set their devices up. | The Block |
| 9 Oct | Researcher tanuki42 counts more than $72 million moved to suspected theft addresses. Specter puts it above $86 million. Some headlines say $90 million. All three are third-party estimates Ledger hasn't confirmed. | The Block |
| 10 Oct | Ledger confirms one affected user's device contained an "unauthorized hardware implant." | BleepingComputer |
| 11 Oct | Ledger calls the number of affected devices "limited" and says every confirmed case was sold through CryptoBilis. CryptoBilis stops selling all hardware wallets. | The Hacker News |
| 13 Oct | Ledger explains how the implant works: it reads the screen during setup and sends the recovery words out over mobile data. | The Hacker News |
| 13 Oct | MediaMarkt Saturn pulls Ledger wallets from its stores and websites after a customer in Germany reports an implant. Ledger says no funds were lost in that case. | 24/7 Wall St, The Hacker News |
| 13 Oct, 6:03 p.m. ET | Ledger asks resellers and distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to stop sales and clear their shelves. It says all confirmed drains are still in Southeast Asia. | The Hacker News |
Sources: The Block, 9 Oct; BleepingComputer, 12 Oct; The Hacker News, updated 13 Oct; 24/7 Wall St, 13 Oct.
What isn't confirmed matters as much. Nobody has a solid count of victims or tampered devices. Nobody has said who fitted the implants or where in the supply chain it happened. Former Mt. Gox boss Mark Karpelès says a Ledger Flex he bought at Singapore's Changi Airport had a spy chip too. That claim hasn't been independently verified, and Ledger hasn't said whether any wallet bought outside CryptoBilis was actually drained.
Prefer to watch? The Ledger implant and what to do, in under a minute.
How the implant reads your 24 words at setup
A hardware wallet keeps your keys on a locked-down chip, the Secure Element. The implant leaves that chip alone. It doesn't need it.
When you set up a new Ledger, the screen shows your 24 recovery words one at a time so you can write them down. Those words are the master key. Anyone who has them can rebuild your wallet on another device and empty it, no PIN, no device needed. According to Ledger's description, reported by The Hacker News on 13 October, the implant is a separate part fitted inside the case. It watches what the screen displays, spots the recovery-phrase screens, decodes the words with its own small processor, and sends them out over LTE using a built-in eSIM. Basically a tiny phone hiding in your wallet.
Ledger says it doesn't touch the Secure Element or Ledger's software, and it doesn't change your transactions. So the device works normally. It just leaks the one thing that matters, once, at setup. The thief can sit on those words and drain the wallet weeks later.
That's also why Ledger's Genuine Check won't catch it. The check tests the chip. Ledger itself warns it can't detect added hardware when the original Secure Element is still in place. A tampered wallet can pass.
Where did you buy it? The 2-minute check
The risk follows the box. Tibane Labs, which examined implants for this case, found three versions, and one was in a device bought on Amazon Japan from a third-party seller in China and shipped from Malaysia, The Hacker News reported. So go by where yours came from.
| Where you bought it | What we know | What to do |
|---|---|---|
| Ledger's own online store | No confirmed cases reported | Carry on. Never give your 24 words to anyone, and ignore anyone who asks. |
| Authorized reseller | CryptoBilis, or any seller in the seven paused markets: highest risk. MediaMarkt and other stores: one reported implant in Germany, no reported loss. | Still sealed: don't set it up, and contact the seller or Ledger support. Already in use from those seven markets: new phrase on a device bought direct, move funds now. Other stores: think through where the box has been. If anything about it bothers you, move to a new phrase. |
| Marketplace or secondhand (Amazon third-party, eBay, classifieds) | One implant found in an Amazon Japan third-party sale | Treat the phrase as exposed. Make a new one on a device bought direct and move your funds. |
| Gift, or you don't know | No way to check the chain of hands | Same as a marketplace buy. Move to a new phrase on a device you bought yourself. |
⚠ Red flag
If your recovery phrase came printed on a card, or was already filled in when you opened the box, someone else has it. CryptoBilis's own alert says to treat a wallet as unsafe if anyone but you has seen the phrase. Move your funds today, wherever you bought it.
What to do if you're worried: move to a fresh seed
This is the step that fixes it. The old device can still sign the transfer, so you never need to type, photograph or share the old 24 words. Ledger's own advice to affected buyers was the same: move assets to a new signer with a new seed.
- Get a new device bought direct. Order from the maker's own store, typing the address yourself rather than clicking a link from an email or ad. The brand is your call.
- Set it up yourself. The device should generate a brand-new 24-word phrase on its own screen. Write it on paper. Never accept a phrase that came in the box.
- Send a small test amount first. From the old wallet to the new one. Check the receiving address on the new device's screen, then confirm it arrived.
- Move the rest. Go chain by chain. Move tokens before the native coin, so you still have ETH, TRX or similar to pay the network fee.
- Retire the old phrase. Once the old wallet is empty, don't send anything to its addresses again. Update saved withdrawal addresses on any exchange you use.
If the device is still sealed and came from a flagged seller, skip all this. Don't set it up. Contact the seller or Ledger through a support address you type yourself. If you're weighing whether to keep coins on a hardware wallet at all, our hot wallet vs cold wallet guide lays out the trade-offs.
Scams that will ride this story
Every big wallet scare brings a second wave of scammers. Ledger has been through it before. After customer contact details leaked online in December 2020, criminals mailed altered "replacement" Ledgers to buyers with a letter asking them to enter their recovery phrase, BleepingComputer reported in June 2021. Expect versions of these now:
- Fake "Ledger recall" emails and texts. They'll say your device is affected and offer a free replacement, or tell you to "migrate" by entering your 24 words. Ledger says it will never ask for your recovery phrase.
- "Check your device" sites. A page that asks for your phrase, or asks you to connect your wallet and sign something to "verify" it. Signing an unknown request can hand over your tokens, the same trick behind wallet mining scams.
- Recovery offers. Someone promises to trace and claw back stolen crypto for an upfront fee. The FBI warned in an August 2023 alert that private recovery companies can't issue seizure orders. A demand for a fee before you get money back is the same pattern as the withdrawal fee scam.
Already lost funds? Write down the transaction hashes and the addresses your coins went to. Contact Ledger support and SEAL 911, the volunteer security group researchers pointed victims to, and file a report at ic3.gov. Then ignore anyone who contacts you first.
Rob's take
I've held bitcoin since 2011. What I'd look at now is the trip the box took. One that passed through three sets of hands before it reached me in Belen, I'd treat as opened. The fix is dull and it works: a new phrase on a device you trust.
FAQ
Is my Ledger affected if I bought it from Ledger's own store?
Nothing reported so far points at devices bought direct from Ledger. Ledger says every confirmed drain involves devices sold in Southeast Asia, and that its own systems weren't breached. Keep your 24 words private and carry on.
Was Ledger hacked?
Ledger says no. It says it has no sign its infrastructure, systems or services were compromised. The devices were tampered with physically somewhere between the factory and the buyer.
Will Ledger's Genuine Check detect the implant?
No. Genuine Check tests the Secure Element chip, and Ledger warns it can't detect added hardware while the original chip is intact. A tampered device can pass the check.
How much was stolen?
Nobody knows for sure. Third-party estimates run from more than $72 million (tanuki42) to more than $86 million (Specter), with some headlines saying $90 million. Ledger hasn't confirmed any of these figures or a victim count.
I've had my Ledger for years. Am I safe?
Ledger's warning to CryptoBilis buyers covers the last 90 days. If you bought from Ledger directly, nothing reported points at you. If yours came from a marketplace or secondhand seller and you have any doubt, a new phrase on a device bought direct settles it.
Should I switch to another brand?
Any brand bought through a bad seller carries the same risk, because this attack happened in the supply chain. Where you buy matters more than the logo. Buy direct from the maker, whichever you choose.
Can I spot a tampered Ledger by looking at it?
Not reliably. The implant sits inside the case, and opening a device can damage it. Go by where it came from, and treat any pre-printed recovery phrase as stolen.
Someone from Ledger support contacted me. Is it real?
Assume it isn't. Ledger says it will never ask for your 24-word recovery phrase. Don't click links in the message. Reach support through an address you type yourself.