Ledger confirms hardware wallet spy implant behind crypto thefts
Ledger said the implant can capture 24-word recovery phrases and send them over a cellular network, and investigators estimate losses at more than $100 million.
- On October 9, 2026, Ledger launched an investigation into cryptocurrency losses involving devices sold by Southeast Asian reseller CryptoBilis, confirming some units contained unauthorized hardware implants designed to steal user recovery phrases.
- Ledger Donjon security team revealed the implants use a microcontroller to read recovery phrases displayed during device setup, then transmit data via cellular networks using an embedded SIM without compromising the device's Secure Element.
- Blockchain analytics firm Bitquery estimated suspected thefts of approximately $102 million across 324 wallets, while independent investigator Specter identified losses exceeding $86 million; Ledger has not verified these totals.
- Following the discovery, CryptoBilis suspended all hardware wallet sales while Ledger introduced new security requirements for authorized retailers, urging customers who purchased devices within the past 90 days not to initialize them.
- Ledger continues collaborating with law enforcement to trace stolen funds, while maintaining that internal systems remain secure; the incident exposes persistent supply chain vulnerabilities affecting hardware wallet distribution globally.
141 Articles
141 Articles
Components have been added to steal passwords from an unknown number of Ledger Nano X wallets, marketed by a reseller in Southeast Asia.
For a long time, a storage method for cryptovalues was considered quite safe: hardware wallets. Now an elaborate attack is causing a stir, more than 100 million dollars are missing. The shock waves range up to Saturn and MediaMarkt.
Manipulated Ledger Wallets are said to have allowed cryptocurrencies to be stolen. A suspected case in Germany has consequences for trade.
Ledger to Review Sale Policies After Crypto Spyware Attack
Crypto hardware maker Ledger SAS is reviewing its policies and processes for how its devices are sold to consumers, after spyware implanted in some wallets led to an estimated $90 million in stolen cryptocurrency.
Coverage Details
Bias Distribution
- 62% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
