Ledger Spy Chip: $93M Stolen Through the Screen

On Friday 9 October, Ledger asked a reseller called CryptoBilis to stop shipping its devices. By then the money was already gone. On-chain researchers had traced more than $72 million into a cluster of suspected theft addresses, all of it drained from people who had recently set up a brand-new hardware wallet bought in Malaysia, Indonesia or the Philippines.

Four days later Ledger explained how. Someone had opened the devices before sale, fitted a small circuit board behind the screen, and closed them up again. When the owner switched the device on for the first time and the display showed the 24-word recovery phrase, the implant read the words off the screen, decoded them, and sent them over the mobile network through an embedded eSIM. The thief had the keys before the owner had finished writing them down.

What the chip did, and what it didn't

Ledger was precise about the scope in its 13 October update. The implant did not touch the Secure Element, the chip that actually holds the private keys. It did not modify the operating system. It did not alter a single transaction or signature. Every security feature worked exactly as designed. The attack simply waited for the one moment the secret is shown in plain sight, then copied it.

That is also why Ledger's Genuine Check cannot catch it. The check verifies the Secure Element, and the Secure Element was real.

Researchers at Tibane Labs pulled two boards apart over the weekend of 10 and 11 October and found two versions. One swapped the original battery for a smaller one to make room. The other squeezed into the foam padding under the OLED display. Both used a common STMicroelectronics microcontroller, a 2 mm eSIM and a shielded LTE module, with the part markings scraped off. The boards were panelised flex PCBs, the kind a factory produces by the sheet. This was not one person with a soldering iron.

Mark Karpelès, the former Mt. Gox chief executive, had been chasing earlier, cruder implants built with hand-soldered wires. He called the new design "quite an evolution."

How much was taken

Ledger has not confirmed a figure. The analytics firms have. Bitquery traced $93.2 million leaving 315 wallets across six blockchains: about $70.5 million in USDT and other assets on Tron, $16.8 million in bitcoin, $3.7 million in ether, and smaller amounts on BNB Chain, Polygon and Solana. YFarmX counted $94.5 million from 521 addresses on seven chains.

The sequence was planned. The thief's addresses were created on 25 September, and test transactions went through before the main sweep in early October. On 9 October, the attackers reportedly changed the permissions on 30 Tron wallets and then moved 203.8 BTC out of 111 Bitcoin wallets in a single block. You cannot do either of those things without the private keys.

It is smaller than the Bitget breach in September, but that one hit an exchange's own wallets. This one emptied private hardware wallets, the thing people buy precisely so an exchange failure cannot touch them.

Tether froze about $10 million of the USDT. Set that against the $70 million that sat on Tron and it is a thin result. The rest moved fast. Bitquery could still follow roughly $81 million on-chain as of 11 October, with part of it already routed through Tornado Cash and Zcash. Nobody can freeze the bitcoin or the ether at all.

Every confirmed case so far involves a device sold by CryptoBilis, which was listed on Ledger's own website as an authorised reseller. Ledger says the number of affected devices is "limited" and that its own systems and direct sales channels show no sign of compromise. Plenty of people on X did not accept that framing. One summed it up as "not a CryptoBilis incident, it's a Ledger incident." CryptoBilis co-founder Arravind Prabu has said the company was acquired in March 2026 and that access credentials changed hands then. It has since closed its shops in all three countries.

Two further reports are open. Ledger says MediaMarkt Saturn, the German electronics chain, paused sales after a customer there reported an implant. Karpelès says he found one in a Ledger Flex bought at Singapore Airport. Ledger has not confirmed a tampered device from any seller other than CryptoBilis.

If you bought a Ledger recently

Ledger's advice is blunt. If the device came from CryptoBilis in the last 90 days and you have not set it up, don't. If you have, move everything to a new device with a freshly generated recovery phrase, and generate that phrase on the new device, not the old one.

Two things worth adding. The warning sign in these cases was price. Tampered units reportedly sold for close to half the cost of a genuine one, and a sealed box plus a passing Genuine Check is not proof the hardware is untouched. And buy from the manufacturer, or from a reseller you can hold to account, never from a marketplace listing. Tibane's samples came from Amazon Japan and Yahoo! Auctions Japan, one of them shipped from Malaysia.

The part that reaches everyone else

You may never own a Ledger and still end up holding this money.

Ninety million dollars does not sit still. It gets split, bridged, swapped and sold. The ether gets turned into stablecoins on decentralised exchanges and through over-the-counter desks. The USDT that escaped the freeze gets offloaded in P2P trades, often to people buying a few thousand dollars' worth with a bank transfer. The bitcoin goes through mixers and comes out the other side into fresh addresses that look ordinary.

Within weeks, some of those coins land in the wallets of freelancers, small shops and traders who did nothing wrong except accept a payment without looking at where it came from. Analytics firms have already tagged the theft cluster, and exchanges run those tags against every deposit. If your incoming funds sit two hops from a flagged address, the deposit gets held and you get a source-of-funds email.

That is the uncomfortable asymmetry. Ledger's victims lost their money at setup. The next wave loses access to theirs when a compliance desk notices where it has been. The fix takes seconds: before you accept a transfer from someone you don't know, check the sending address for sanctions hits, mixer exposure and links to known theft clusters. Clean, take the payment. Not clean, you have just avoided a very long conversation with a bank.

Hardware wallets still beat leaving coins on an exchange. But a device is only as trustworthy as the hands it passed through before yours, and the coins you receive are only as clean as the wallet that sent them. Check both.