Spy implant in Ledger wallets and how to protect your crypto

13/10/2026

Last updated: October 13, 2026

In early October, more than $86 million was stolen from Ledger hardware wallets. Ledger confirmed that at least one victim's device contained an unauthorized hardware implant: a small board that captures the seed phrase and sends it to the attackers.

All confirmed cases involve CryptoBilis, an authorized Ledger reseller in Southeast Asia. Ledger says its infrastructure and direct sales were not affected. Software can't detect implants like this, though, and independent researchers are already finding them outside Asia.

PassimPay is a crypto payment gateway for businesses. Many B2B companies in our market keep revenue and reserves on Ledger hardware wallets, as well as on Trezor, Tangem and other devices. That's why we decided to share this news. Below are the verified facts and practical steps to help you assess the risk to your assets quickly.

Timeline

October 9. On-chain analyst Specter traced more than $86 million moved out of hundreds of wallets on Bitcoin, Ethereum and TRON. The same day, Ledger opened an investigation and asked CryptoBilis to stop sales and shipments.
October 10. Ledger confirmed an implant in one victim's device and said it was working with law enforcement. CryptoBilis paused sales of all hardware wallets.
October 11. Ledger described the number of affected devices as "limited" and told resellers to buy stock only through authorized channels and never to resell returned devices.
October 12. Bitquery analysts put the losses at about $93 million from 315 wallets across six networks. Tether froze about 10 million USDT. Ledger hasn't confirmed these figures.
October 13. Ledger's security team, Ledger Donjon, published its analysis of the attack and confirmed how the implant works. Ledger said it hasn't verified any drain linked to a device bought from a seller other than CryptoBilis. The total number of victims and the total loss are still unconfirmed: according to Ledger, the figures circulating online come from third parties.

How the implant works

The implant reads the seed phrase off the screen while the wallet is being set up. Mark Karpelès, who opened a sealed Ledger bought in Malaysia, and researchers at Tibane Labs were the first to describe how it works. On October 13, Ledger's security team, Ledger Donjon, confirmed the mechanism:

A separate board with a microcontroller, an LTE module, an eSIM and an antenna sits under the screen, where the display padding normally goes.
When the device shows the 24 words, the board reads the screen and stores the seed phrase.
The phrase goes to the attackers over the mobile network, and they restore the wallet on their own device. After that they don't need the hardware wallet at all.

The Secure Element chip stays original, so the wallet passes Ledger's Genuine Check. Ledger itself says the check can't detect added implants. The only way to find the board is to open the case. According to Ledger Donjon, the implant doesn't change the Secure Element or the Ledger operating system, and it doesn't alter transactions or signatures. Its only job is to steal the phrase.

Implants have turned up in the Ledger Stax as well as the Nano X, and that Stax was bought from CryptoBilis. A user in Germany reported two compromised Ledger devices from different MediaMarkt stores and sent one of them to Ledger for analysis. Ledger hasn't confirmed the European cases yet, but says it is reviewing reports of implants in other devices and locations.

Security recommendations

The surest way to protect yourself is to move your assets to another address with a new seed phrase, at least for now. The implant steals the phrase itself. Changing your PIN or updating firmware won't help: if the phrase leaked, the attackers already have access.

Move your assets somewhere else if your wallet wasn't bought directly from the manufacturer. Use a new wallet with a new seed phrase generated on a device you trust. Don't rely only on the "last 90 days" window in Ledger's advice. According to Bitquery, more than 80% of the drained wallets first received funds in June or later, so earlier purchases may also be at risk.
Don't set up a new device from CryptoBilis or another third-party seller while the investigation is ongoing. Don't enter or restore any seed phrase on such a device. Buy new wallets only from the manufacturer's official website.
Spread the risk. Large amounts are safer in a multisig wallet that needs several devices to sign a transaction. If one device is compromised, the attacker still can't move the funds.
Watch out for phishing. Scammers are already using the incident. Ledger never calls, never sends direct messages and never asks for your seed phrase. Support works only through support.ledger.com.
If you've already lost funds, contact Ledger Support and file a police report. Don't send the device to anyone or open it until you've spoken to Ledger Support or the police.

Some owners are now weighing their wallets and comparing the result with the factory weight to spot an extra board without opening the case. That's no guarantee. In one version of the implant, the attackers swapped in a smaller battery, so the weight may stay the same.

If you didn't buy from CryptoBilis and want to look inside your wallet, Ledger has published a guide to opening the device. Make sure your seed phrase is backed up first, because opening the case can damage the device.

What this means for businesses

Crypto security depends on how your wallet reached you as much as on which wallet you chose. Even an authorized seller can't guarantee that nobody opened the device on the way.

So check where your team bought its wallets, and don't keep all your reserves on one device. These are standard security practices that everyone should follow, however reliable a wallet or service is. The golden rule for any assets applies here: don't put all your eggs in one basket.

PassimPay helps companies accept crypto payments and keep their assets safe. We have also helped our merchants protect their funds more than once when their services came under hacker attacks. If you'd like to talk about how to accept crypto payments and manage revenue safely in your business - contact us.

FAQ

Was Ledger itself hacked?

There's no evidence of that. Ledger says its systems and direct sales weren't compromised. The implants were added to devices on their way to buyers.

Is only the Ledger Nano X at risk?

No. An implant was also found in a Ledger Stax, the company's premium model, bought from CryptoBilis.

Does this only affect Asia?

All cases confirmed by Ledger involve CryptoBilis, a reseller in Indonesia, Malaysia and the Philippines. A user in Germany, though, reported two devices with implants bought at MediaMarkt, and Ledger says it is reviewing reports of implants in other locations.

I bought my Ledger on the official website. Do I need to do anything?

Ledger says devices from direct sales aren't affected. The urgent steps apply to people who bought through resellers, marketplaces or second hand.

Does this affect other brands?

So far implants have only been found in Ledger devices. CryptoBilis also sold wallets from other makers, including Trezor, so their owners may want to move their assets to a new seed phrase.

Can I check my wallet without opening it?

There's no reliable way. Weighing the device can raise a red flag, but it can't prove the device is clean. Your best option is to create a new seed phrase on a device you trust.

Should I stop using hardware wallets altogether?

No. The attack happened in the supply chain. A hardware wallet bought directly from the manufacturer is still one of the safest ways to store crypto, especially combined with multisig.

Can a business accept crypto directly to a Ledger wallet?

Yes. You can give a customer your wallet address and receive the transfer. But matching payments to orders, payment status notifications, reporting and transaction risk checks are things the business will have to set up separately.

How is PassimPay different from Ledger?

Ledger helps you control your keys and sign transactions from your wallet. PassimPay helps businesses accept and process customer payments through checkout, invoices, an API and other payment tools. They cover different parts of the process and can be used together.

Can a customer pay a PassimPay invoice from a Ledger wallet?

Yes, as long as Ledger supports the asset and network. The customer sends funds to the address on the invoice. Before sending, they should double-check the network, the address and the amount.

What should I do if my funds are already gone?

Contact Ledger Support through support.ledger.com and file a police report. Don't send the device to anyone or open it until you've spoken to Ledger Support or the police. Don't trust "crypto recovery services" that contact you first.