Crypto: a spy chip hidden in Ledger wallets, how to buy yours without getting scammed?

You buy a brand-new crypto wallet from an official reseller, the box is sealed, the little plastic film is intact, the manufacturer's app tells you "authentic device", you write down your 24 secret words on the card provided for that purpose, you put the whole thing away in a drawer telling yourself "well, it's sealed, it's official, I'm safe", and a few weeks later your account is empty. This is exactly what just happened to the owners of more than three hundred wallets in Southeast Asia. There was a second chip in the box. A spy chip, with its own SIM card!

The manufacturer is Ledger, the French company that has been selling these little keys for more than ten years. The reseller is CryptoBilis, a shop in Kuala Lumpur, Malaysia, which appeared on Ledger's official list of resellers for Malaysia, Indonesia and the Philippines. And the haul exceeds 100 million dollars.

The box was sealed. The inside, much less so

What is a hardware wallet?

For those who have never held one: it's a small USB-stick-sized device, with a screen and two buttons. It keeps the codes that give access to your crypto offline, which is called a "cold" wallet. Even if your computer is infested with viruses, the hacker can't sign anything without pressing the buttons on the device, and they don't have it.

There is only one weak point, and everyone knows it: the recovery phrase. When you turn it on for the first time, the device displays 24 words on its little screen, and you copy them down on paper. Those 24 words are the key to the vault. If you lose the device, you buy another one, enter your 24 words, and you get everything back. It works for a thief too. Whoever has the 24 words has the money, on any device, anywhere in the world. It's a safe that opens with a little poem, brilliant as long as you're the only one who knows the poem!

How the chip read the 24 words

The person who opened the case is Mark Karpelès, the former boss of Mt. Gox, the platform that collapsed in 2014 with hundreds of thousands of its customers' bitcoins. The irony of the story is that he's playing detective this time. He bought a Ledger in Malaysia, took it apart, and posted the photos on X : under the screen, where there should be a simple foam pad, an extra thin electronic board, with a small processor, an antenna, a mobile-phone chip and an eSIM, that is, a soldered SIM card, like in recent phones.

The principle is as simple as can be. The spy chip watches what appears on the screen. When the device displays the 24 words during setup, it records them, then sends them over the mobile network, exactly like your phone sends a text message. It doesn't even need your Wi-Fi. The thief receives the list, quietly waits for you to fill the vault, and empties it from another device, thousands of miles away.

You copy down your 24 words, he reads them at the same time as you

And the worst part is that the authenticity check saw nothing. The Ledger app runs a test when you connect it, the Genuine Check, which queries the device's security chip to verify that it is really genuine. It was! The safe was authentic. It was the hidden camera above it that wasn't. According to Karpelès, the only way to spot the intruder is to open the device.

Ledger confirmed on October 11 on X that it had found "an unauthorized hardware implant" in at least one victim's device. The technical details of the chip, on the other hand, come from Karpelès's photos, not Ledger. And one thing is reassuring in this story: Ledger's security chip was not broken. The trap was placed next to it.

102 million, and above all digital dollars

The analysis company Bitquery, which follows the money from wallet to wallet across blockchains, did the math: $102 million taken from 324 wallets, across six different blockchains, according to its figures verified on October 13. Other estimates, like Galaxy Digital's reported by Bloomberg, are around $90 million. Ledger, for its part, gave no figure.

Nearly four out of every five stolen dollars were USDT on Tron

The biggest share, $79 million, was in USDT, those tokens that are always worth one dollar, stored on Tron, a blockchain widely used in Asia to send money abroad without going through a bank. It makes sense: in that region, many people keep their savings in digital dollars to protect themselves from their local currency. They weren't speculators, they were savers.

And the thief didn't do this on a whim. Bitquery found small test transfers starting on September 25, like a burglar checking that the key turns properly in the lock, then the big draining, all at once, on Friday, October 9. Tether, the company that issues USDT, froze $10 million right away, because it can block its own tokens. Good news for those people. The rest went into Tornado Cash, a service that mixes the crypto of lots of people to muddy the trail, and into exchanges for other tokens that nobody can freeze. In short, a pro.

How the shop became a trap

This is the part that sends the biggest chill down your spine. CryptoBilis was sold in March 2026, according to one of its former co-founders, and in August it was entirely owned by a person domiciled in northeastern China, according to Crowdfund Insider. Nothing public proves that this change of ownership explains the chips. But Bitquery noticed that more than eight out of ten emptied wallets had received their first funds in June or later.

See the problem? An honest shop, with years of good reviews and its name on the manufacturer's official website, changes hands without anyone noticing, and the « official reseller » badge keeps reassuring customers. The name on the door is the same, the person behind the counter isn't.

And here at home, in Belgium?

Ledger says that nothing it sells directly was affected. But a user claimed on X that Ledgers sold in Europe at MediaMarkt had been tampered with in the same way. Nothing confirms it for now, and Ledger has not commented on it. Except that MediaMarktSaturn, the group behind MediaMarkt, told Bloomberg it had removed all Ledger products from its stores and websites, while it worked things out with the manufacturer. Retailer caution, not an admission: but if you were planning to buy one this weekend at your local MediaMarkt, it'll have to be somewhere else.

And things are moving at competitors too: OneKey and Trezor, two other wallet manufacturers, are reviewing or suspending some of their resellers. OneKey's boss talks about a year's revenue at stake. This isn't just a Ledger matter, it's the whole “bought from an intermediary” model that has just taken a hit.

How to buy yours without getting ripped off

The good news is that the countermeasure is simple.

Buy from the manufacturer, on its own website. Not from a reseller, even one displayed as “official”, not on a marketplace, and especially not second-hand. A crypto wallet isn't a charging cable: saving ten euros with a stranger to protect thousands of euros is the wrong calculation.

One less intermediary means one less screwdriver between the factory and you

If you bought your device from CryptoBilis, Ledger's guidance is clear: don't turn it on if it's still in its box, and if it's already in use, move everything to a new device bought directly from the manufacturer, with a new 24-word phrase. Ledger talks about the last 90 days, but given the dates identified by Bitquery, I would go back as far as June without hesitation.

If you have any doubts about a device bought elsewhere, same remedy: a new device from the manufacturer and a new phrase. It takes half an hour and a few transaction fees. Much cheaper than an empty account!

And one last reflex, because scammers will ride the panic in the days to come: Ledger will never call you, will never send you a private message and will never ask you for your 24 words. Nobody asks for them for good reasons. Ever.

So, is it Ledger's fault?

Not really, and at the same time a little. Ledger was not hacked in the strict sense, its chip held up, and its app told the truth about the only thing it was checking. But for the victims, that changes absolutely nothing. They did everything they had been taught: sealed box, official reseller, authenticity test showing green, words written down on paper and not on the phone. And it wasn't enough. What a dirty move!

What worries me is what comes next: if a spy chip with its SIM can fit under the screen of a thumb-sized key, it can fit into so many other things that we plug in at home without giving it a thought, and honestly, I won't look at a "sealed" package the same way anymore.

Sources

• Ledger Support on X, 9 October 2026: investigation into the losses of CryptoBilis buyers and sales halted
• Ledger on X, 11 October 2026: 72-hour update and hardware implant confirmed
• Bitquery, investigation published on 9 October 2026, figures verified on the 13th: $102 million, 324 wallets, six blockchains
• Help Net Security, 12 October 2026: the implant described by Mark Karpelès and the Genuine Check
• Crowdfund Insider, 11 October 2026: CryptoBilis resales in 2026
• Crypto Briefing, 13 October 2026, according to Bloomberg: MediaMarkt removes Ledger products, Ledger reviews its sales
• Ledger Support: official channels, Ledger never asks for your recovery phrase

Article written with the help of Claude Code, reread and corrected by me.