More examples of Ledger wallets being tampered with and fitted with physical spyware have allegedly been identified across Asia, Europe, and South America.
Ledger users who bought hardware wallets from Malaysia-based reseller CryptoBilis were drained of over $86 million last week.
Former Mt. Gox CEO Mark Karpelès discovered that spyware implanted in some Ledger devices was being used to read their screen output. It could record any seed phrase while remaining undetected by Ledger’s Genuine Check security protocol.
Ledger confirmed yesterday that the incident on October 9 affected a “limited” number of devices sold by CryptoBilis.
“We are reminding our authorized resellers and distributors to source products only through authorized channels and never to restock returned products,” it said.
More Ledger wallets flagged with spyware
Self-proclaimed semi-professional airdrop farmer “@0xJohannes_” claimed to have unpacked a Ledger device with a spy implant that was bought directly from Ledger’s official German reseller MediaMarkt.
The device did not appear to redirect any funds to an exploiter, with the X user noting, “Either the device didn’t work or they were waiting for a more widespread usage of the comprised devices.”
They also claimed that “there are reported cases in Asia, South America, and now Europe as well.”
PSA the ledger incident isn't limited to Asia
— Johannes (4, 4) (@0xJohannes_) October 11, 2026
This is a device purchased in store from an official reseller in Europe (a legitimate device doesn't have any of these cables as can be seen in picture 2)
This even seems to be an old version of the 'spy implant' even though the… pic.twitter.com/bLWrN9aooK
Read more: Ledger says Southeast Asia reseller linked to $86M draining
Another X user, “@Us_Chan007,” shared pictures of the interior of a Ledger wallet they bought from official Philippine reseller LazMall.
Karpelès noted this wallet was fitted with an earlier style of spyware in the form of a “manual coil antenna.”
He also helped identify spyware implanted in one of Ledger’s Stax models shared by X user @wentrre, who’d also bought from CryptoBilis.
Very much a problem! Move your assets as soon as possible from any seed that touched this device
— Mark Karpelès (@MagicalTux) October 11, 2026
Read more: Ledger sued for $500M over its many data breaches
Despite these examples, there are also dozens of users dismantling their Ledger devices out of caution only to be told by Karpelès that they’re “clean.”
Former CryptoBilis exec says firm is under new management
At one point this weekend, attention turned to CryptoBilis’ former CEO, Arravind Prabu, who revealed in an exchange on X that the firm was acquired earlier this year, and that he’s stepped down from all operations.
When quizzed about CryptoBilis’ recent Lamborghini and pizza post, he claims that the account is under new management and that former staff signed a confidentiality clause that meant they couldn’t reveal the company was under new ownership.
Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.
The post Ledger spyware scare spreads beyond Southeast Asia appeared first on Protos.