Ledger Confirms Hidden Chip in Wallet After $92M Crypto Theft Reports

The hardware wallet is supposed to be the last line of defence in crypto self-custody — a small, sealed device that keeps private keys offline and away from hackers. This weekend, that promise was shaken. Ledger, the world's best-known hardware wallet maker, has confirmed finding an unauthorised hardware implant hidden inside one customer's wallet, during an investigation into a wave of thefts linked to a Southeast Asian reseller.

The discovery, confirmed by Ledger Support on 10 October, turns a troubling suspicion into something concrete: at least one device was physically tampered with before it reached its owner. Blockchain researchers estimate the suspected losses at around $92.9 million across 311 wallets — a figure Ledger has not independently verified. The incident is now one of the largest alleged supply-chain attacks in crypto history, and a warning that self-custody is only as safe as the hands a device passes through.

How the reports surfaced

The investigation began on 9 October, when reports emerged of more than $86 million in suspected crypto thefts affecting users in Southeast Asia. The common thread, investigators found, was the seller: the victims had bought their Ledger devices from CryptoBilis, a reseller operating in the region. On-chain analysis traced drained funds across Bitcoin, Ethereum and TRON, suggesting a coordinated operation rather than isolated bad luck.

Ledger responded quickly, asking CryptoBilis to halt all sales and shipments of its devices while the company investigated. The reseller has since suspended sales of all hardware wallets as a precaution. In a statement, Ledger Support confirmed the discovery of the implant in a device belonging to one of the affected users, adding that it was contacting impacted customers and working with authorities.

Ledger has been careful about what it claims. The company has not established whether the implant caused the reported cryptocurrency losses, and it has not verified the researchers' loss estimates. But the physical confirmation — a real, unauthorised chip inside a real customer's wallet — lends weight to the theory that tampered hardware, not a software flaw, is behind the thefts.

A chip hidden in plain sight

The most vivid evidence came from Mark Karpelès, the blockchain researcher and former Mt. Gox chief executive, who reported finding suspicious electronics concealed behind the screen of a Ledger Nano X in Malaysia. The placement is no accident: the screen is where the wallet displays the 24-word recovery phrase during setup — the master key to everything the device protects.

According to analysis of the incident, the implant is designed to read the recovery phrase off the screen at the single moment it is visible, then relay it to the attackers. It is, as one industry write-up put it, a textbook version of the attack that Ledger's own security guidance has warned about for years. The device's cryptography never fails; it is simply bypassed at the human-readable step.

That is what makes the attack so insidious. The wallet behaves normally. The setup looks normal. The screen shows the words it is supposed to show. The user has no way of knowing that an extra set of eyes is watching — until the funds disappear.

The scale of the suspected losses

Blockchain analytics firm Bitquery estimated losses of $92.9 million across 311 wallets, with funds drained across multiple networks including Bitcoin, Ethereum and TRON. Other researchers have put the figure in the $86–93 million range. None of these totals has been independently confirmed by Ledger, and the true number may not be known until the investigation — and the cooperation of affected users — runs its course.

For context, the reported thefts do not appear tied to any market event. Bitcoin was trading at roughly $82,990 on 10 October, up slightly on the day, so the losses look like a direct consequence of compromised hardware rather than a price shock. The scale suggests the operation ran for some time before the pattern was noticed — resellers can move thousands of devices, and a tampered batch can sit in drawers for months before being set up.

Anatomy of a supply-chain attack

Supply-chain attacks exploit the gap between the factory and the front door. A hardware wallet is only as trustworthy as its journey: from the manufacturer's production line, through distributors and resellers, to the buyer's hands. Anyone with physical access in that chain can open the device, add components, reseal the packaging and return it to circulation — and the victim receives what looks like a factory-fresh product.

This is precisely the scenario Ledger's own guidance has long cautioned against. The company advises buyers to purchase only from Ledger directly or from authorised retailers, to verify that the device generates a brand-new recovery phrase on first use, and to treat any pre-filled or pre-configured wallet as compromised. The CryptoBilis case is that warning made real: the protection only holds if the device arrives exactly as the manufacturer shipped it.

The incident also reframes a common assumption about self-custody. Moving funds off an exchange into a hardware wallet is the standard advice for escaping custodial risk. But that advice has a hidden dependency — the integrity of the hardware itself — that most users never think to question. For buyers weighing self-custody options, the purchase path now deserves as much scrutiny as the device.

What hardware-wallet owners should do now

Ledger's advice is specific and urgent. Customers who bought devices from CryptoBilis within the past 90 days and have not yet set them up should not do so. Those who already initialised such devices should transfer their assets to a new device — bought directly from the manufacturer — using a completely fresh recovery phrase, then stop using the old one.

More broadly, every hardware-wallet owner should run through a short checklist. Buy only from the manufacturer or an authorised seller — never from auction sites or unfamiliar resellers. On first setup, confirm the device generates a new seed phrase itself; if the screen shows words you did not create, stop immediately. Verify the device's authenticity through the manufacturer's official app, which can detect many forms of tampering. And never enter an existing recovery phrase into a new device of uncertain origin.

If you are holding significant crypto, consider diversifying: spread funds across multiple wallets from different manufacturers, so that a single compromised batch cannot take everything. And keep an eye on the market value of what you hold — a quick check of live prices on a trusted crypto converter helps you reconcile your balances and spot unauthorised drains early.

Why it matters

The Ledger case is a reminder that crypto security is a chain, and attackers go for the weakest link. Software gets the headlines, but physical tampering — quiet, scalable and nearly invisible — may be the more dangerous threat, because it defeats every cryptographic protection at once. A $92 million lesson, paid by hundreds of users who did everything right except check where their wallet came from.

For the industry, the fallout will likely mean tighter controls on authorised resellers, better tamper-evidence in packaging, and renewed pressure on manufacturers to make device authenticity verifiable by ordinary users. For everyone else, the rule is simple: the cheapest seller is not always the safest. When the device guards your keys, buy it like it matters — because it does.