Ledger confirms spy chip implant behind wallet crypto thefts
Ledger confirms hardware implants in some devices sold by CryptoBilis led to crypto theft.
Run Ledger?
Get an email when a reviewed story names Ledger, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Ledger has confirmed that a hardware implant was found in some of its cryptocurrency wallet devices distributed by Southeast Asian reseller CryptoBilis, leading to user funds being stolen. The company is investigating how and when the devices were tampered with, advising affected users to move their assets to a new device. Researchers have identified two versions of the implant, which captures display output and button presses to steal seed phrases and transmit them via an LTE connection.
The lesson from this incident
Full lessonTampered Ledger hardware wallets distributed through a Southeast Asian reseller were found to contain spy chips capable of capturing seed phrases and transmitting them over LTE, resulting in direct theft of user funds. The root cause is a compromised supply chain, where a third-party reseller introduced malicious hardware implants before devices reached end users. This attack is particularly dangerous because it bypasses all software-level security controls — the device appears legitimate while silently exfiltrating the most sensitive cryptographic secrets. It underscores that trust in a hardware product cannot be assumed solely based on brand reputation; the integrity of the entire distribution chain must be verified.
What helps against this
How we list vendors- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
- Incident response retainer
Experts are on call before the worst day, not searched for during it.