Skip to content

Back to the catalog

Ledger Spyware Scare Spreads Across Asia and Europe
bankless.comarticle

Ledger Spyware Scare Spreads Across Asia and Europe

News roundup on hardware implants found in Ledger wallets sold through authorized resellers, starting with CryptoBilis in Southeast Asia and then Singapore, Japan and German MediaMarkt stores. The implants read the 24-word recovery phrase off the screen during setup and send it out over a hidden cellular link, while Ledger's secure chip stays untouched so the devices look genuine. Researchers describe three generations dating to 2025, each harder to detect. Suspected losses are put at $86M (Specter) to $103M (Yfarmx), and neither figure is verified by Ledger.

TL;DR Hardware implants in reseller-channel Ledger wallets steal seed phrases from the screen and exfiltrate them over cellular; suspected losses exceed $86M.
Open original ↗
Document

What it is

Ledger hardware wallets sold through third-party channels have been found with hidden hardware implants that capture the 24-word recovery phrase. Reports began on October 9 with thefts tied to CryptoBilis, an authorized reseller in Malaysia, Indonesia and the Philippines. Ledger has confirmed at least one implant.

How it works

The implant reads the recovery phrase off the screen during setup and sends it out over a hidden cellular connection. Ledger's secure chip is left untouched, so the device passes as genuine. Researchers describe three generations dating back to 2025, each harder to detect.

Preconditions / Affected

The exposure depends on the purchase channel, and several models and channels are named:

  • CryptoBilis (Malaysia, Indonesia, Philippines): the origin of the thefts. It has halted hardware wallet sales.
  • Singapore airport: Mark Karpelès confirmed an implant in a Ledger Flex bought there, and saw photos of an older-generation implant from another user.
  • Japan: Tibane Labs examined compromised Nano X units bought on Yahoo Auctions Japan and Amazon Japan. The Amazon unit came from a China-based seller shipping from Malaysia.
  • Germany: a user found implants in two Ledgers from separate MediaMarkt stores. Ledger says no funds were lost there. MediaMarkt's parent has halted Ledger sales internationally.

The Singapore and Japan purchases have not been linked to CryptoBilis, so the problem is not confined to one reseller. Ledger says its own systems and direct sales are unaffected.

What to do

The page gives no detection procedure or remediation steps. Its only channel-level signal is Ledger's statement that direct sales are unaffected. Any device bought through a reseller, marketplace or airport retailer, especially in the regions above, falls into the exposed group. Because the implants capture the phrase during setup, a device from those channels that has already been set up may have exposed its seed.

Caveats

  • Loss figures conflict: Specter estimates over $86M and Yfarmx $103M, and Ledger has verified neither.
  • Ledger has confirmed at least one implant but has not confirmed thefts outside the CryptoBilis cases, though it is investigating.
  • Trezor and OneKey have cut ties with CryptoBilis, but the page gives no detail on why.

Organisations named here

  • MediaMarkt

Technologies named here

  • Ledger hardware wallets sold through authorized resellers
  • Ledger Flex bought at Singapore's airport
  • Tibane Labs
  • Ledger
  • Specter
  • YFarmX

Techniques named here

  • Supply chain compromise

Threat actors named here

  • CryptoBilis-linked thefts
  • CryptoBilis

Also named here

  • Mark Karpelès

Related in Hardware & RF