Ledger Spy Chip Scandal Hits Crypto Wallets in Asia

The Ledger spy chip story just went from creepy rumor to full-blown crypto security crisis. Ledger, the Paris-based maker of hardware wallets, says tiny hidden implants inside some of its devices copied users' secret recovery phrases and beamed them to thieves over a mobile network. On Tuesday the company confirmed the mechanism, and by Wednesday it was pulling its products off shelves across Southeast Asia and Hong Kong.

What the hidden implant actually did

A hardware wallet is supposed to be the safest place to keep crypto, because the keys never touch the internet. The recovery phrase is the master key: anyone who has those twenty-four words can rebuild the wallet somewhere else and drain it, no physical device required.

According to CoinDesk, Ledger said the covert hardware sat inside the device enclosure. When a user set up the wallet and the screen displayed the recovery phrase, the implant's microcontroller recognized and decoded the words, then sent them out over LTE using an eSIM. It is basically a cellphone modem hiding where nobody expects one.

Ledger stressed that this was a physical supply-chain attack, not a breach of its software or internal systems. The implant did not touch the secure element, the chip built to protect private keys, and it did not alter transactions or signatures. It simply watched the screen like a camera over your shoulder.

How big is the damage?

Ledger has not confirmed how many people were hit by the Ledger spy chip scheme or how much money vanished. Onchain researchers, cited by CoinDesk, estimate losses of up to ninety-three million dollars across more than three hundred wallets, and Tether reportedly froze ten million dollars of its USDT tied to the theft. The Straits Times reports that blockchain analysts put the figure at more than eighty-six million dollars.

The trouble began when wallet owners reported stolen funds on October ninth. Ledger asked a Malaysian reseller called CryptoBilis to pause sales, then confirmed a day later that at least one affected device carried an unauthorized implant. Every confirmed loss so far traces back to devices sold through that reseller, according to Ledger.

Sales halted across seven markets

The Ledger spy chip fallout keeps spreading. The Straits Times reports that Ledger has now asked resellers and distributors to suspend sales and pull wallets from shelves in Singapore, Malaysia, Indonesia, Thailand, the Philippines, Vietnam and Hong Kong, while investigators work out where the tampering happened.

In Singapore, a tampered device was reportedly found to have been sold at a Changi Airport shop called Metapod, and the newspaper says it has asked both the shop and Ledger for comment. Separately, European retailer MediaMarktSaturn pulled Ledger products across its eleven markets after a customer in Germany reported an implant, per the same report.

Rival Trezor is also reacting. Decrypt reports that Trezor will end its reseller authorizations on the first of January, a sign that the whole industry is rethinking who gets to sell the gear.

How the hardware was modified

Security researchers have been digging into physical examples for weeks. According to BleepingComputer, Tibane Labs found that attackers fitted a small chip, a tiny eSIM and a shielded LTE module into a Ledger Nano X, replacing the original battery with a smaller one to make room. Markings on some parts had been scraped off to hide what they were.

The same report says the implant used a professionally designed flexible circuit board, not a hand-built one-off, and that the telltale sign was a stray antenna wire. Even Ledger's Genuine Check tool cannot catch every case, because the company warns it cannot detect added implants when the original secure element stays intact.

What you should do if you own a hardware wallet

The advice is blunt. Buy only from Ledger directly or from authorized resellers, and be suspicious of deals that look too good: BleepingComputer notes that tampered units were reportedly on offer for nearly half the price of genuine hardware.

If you bought a Ledger from CryptoBilis, Ledger says not to set it up. If you already did, move your assets to a new device with a brand-new recovery phrase, not the old one. Ledger has also said its leadership is reviewing reseller controls and anti-tamper protections and wants researchers and other vendors to help build better chain-of-custody practices.

Anyone who wants to understand why a single hidden part can undo so much security should also browse our science coverage on how hardware gets built and checked. A Ledger spy chip is a reminder that the weakest link can be a shop shelf, not a hacker's keyboard. Each new report adds another piece to the puzzle, and the final tally of victims could still climb.

The bigger lesson for Gen Z crypto holders is that the cold-storage dream has a weak spot before the device ever reaches you. Follow the wider fallout on our crypto page, because this investigation is far from over and more details on who tampered with the devices are still to come.