A hidden chip was found inside some Ledger wallets sold by Asian reseller CryptoBilis. When the device displayed its 24-word seed phrase during setup, the implant read it off the screen and sent it to the attacker over the LTE mobile network via an eSIM.
According to Ledger, the chip didn’t touch the secure element, firmware or transactions. This was a supply chain attack, not a breach of the company itself. All confirmed losses in the October 9 incident involve devices sold by CryptoBilis.
Ledger hasn’t disclosed the number of victims. Onchain researchers estimate losses of up to $93.2 million across more than 300 wallets. Tether froze $10 million in USDT linked to the theft.
Reports of spy chips are coming from elsewhere too. Mark Karpeles, the former Mt. Gox CEO, said he found an implant in a Ledger Flex bought at Singapore Airport. And MediaMarkt Saturn halted sales after a complaint from a customer in Germany.
Ledger advises users not to set up devices bought from CryptoBilis. Anyone already using one should move their funds to a new wallet with a new seed phrase.
