Ledger Confirms Hidden Chip in Wallet Amid Theft Claims

Ledger has confirmed finding an unauthorized hardware implant inside one customer’s cryptocurrency wallet during its October 10 investigation. This inquiry followed reported thefts involving the Southeast Asian reseller CryptoBilis. The manufacturer described the component as an unauthorized hardware implant but did not disclose the exact device model or how it was installed.

Blockchain researchers have estimated suspected losses exceeding $90 million across hundreds of wallets affected by the incident. Bitquery reported figures including $92.9 million in cryptocurrency losses, while other estimates placed losses above $86 million. Ledger has not confirmed either amount or the total number of victims involved.

Former Mt. Gox CEO Mark Karpelès reported finding suspicious electronics behind a Ledger Nano X screen in Malaysia. He described the board carrying a microcontroller, an antenna, an LTE chip and an e-SIM card. The device arrived in packaging that appeared intact to a routine inspection.

A technical analysis suggested the component could capture information displayed during wallet setup. A recovery phrase consists of words that allow a wallet owner to restore access to cryptocurrency holdings. If an attacker obtains those words, they may recreate the wallet without the original hardware device.

Karpelès found implants in devices that did not come from CryptoBilis, raising questions about wider supply chain issues. He traced units to Yahoo! Auctions in Japan and a China-based seller on Amazon Japan. This suggests the tampering could be more widespread than initially thought.

CryptoBilis suspended sales of all hardware wallets while Ledger investigates reported losses. Former executives stated they transferred operational control following an ownership change earlier in 2026. A statement named Nicholas Chang as the current lead person but did not identify the new owners.

Customers who purchased a device through CryptoBilis have been instructed not to begin setting it up if they have not already done so. For customers who have used the devices, Ledger recommends considering a transfer of their cryptocurrency to a new hardware wallet initialized with a completely new recovery phrase. Moving an existing recovery phrase onto a replacement device would not address possible exposure of that phrase.

An X user claimed a Ledger bought at electronics retailer Mediamarkt in Europe also has extra wiring inside. Ledger stated all confirmed cases related to the disclosed draining incident involve devices sold through the Southeast Asia reseller CryptoBilis. The company reminded authorized resellers to source products only through authorized channels and never to restock returned products.

Competitor Trezor has removed CryptoBilis from its reseller list, despite no similar confirmed cases involving their devices. Ledger co-founder Nicolas Bacca noted competitors using the situation to market their own products. The Bitcoin price remained relatively resilient despite the security incident and broader trust concerns in the crypto sector.

The manufacturer emphasized that it has found no evidence suggesting its security systems or services were compromised. It remains unclear how many wallets contain similar modifications. Researchers have not independently confirmed that the discovered implant performed the function of capturing recovery words.