Ledger Spyware Scare Spreads Across Asia and Europe

Ledger hardware wallets sold through authorized resellers are turning up with hidden spyware capable of stealing users' recovery phrases, with suspected losses already exceeding $86 million.

What's the Scoop?

• Initial thefts: On October 9, thefts surfaced involving Ledgers sold by CryptoBilis, an authorized reseller in Malaysia, Indonesia, and the Philippines, prompting a Ledger investigation. Ledger has confirmed at least one hardware implant. Investigator Specter estimates over $86M stolen, while security outlet Yfarmx puts losses at $103M, per Cointelegraph. Ledger hasn't verified either figure. CryptoBilis has halted hardware wallet sales, while Trezor and OneKey have cut ties.

• How the implants work: The implants read the 24-word recovery phrase off the screen during setup, then transmit it through a hidden cellular connection. They leave Ledger's security chip untouched, allowing devices to appear genuine. Researchers have identified three generations dating back to 2025, each harder to detect.

• More discoveries across Asia: Former Mt. Gox CEO Mark Karpelès confirmed an implant in a Ledger Flex bought at Singapore's airport, plus an older version in photos from another user. Tibane Labs also examined compromised Nano X devices purchased through Yahoo Auctions Japan and Amazon Japan, the latter from a China-based seller shipping from Malaysia. Neither purchase has been linked to CryptoBilis.

• Europe joins the investigation: A German user found implants in two Ledgers bought from separate MediaMarkt stores, though Ledger says no funds were lost. MediaMarkt's parent has since halted Ledger sales internationally. Ledger is investigating reports beyond CryptoBilis but hasn't confirmed thefts elsewhere, maintaining that its own systems and direct sales are unaffected.