Chip

Reddit

Tornado Cash

Millions

<ul>
 <li><strong>Ledger confirmed an unauthorized hardware implant inside a customer’s device.</strong></li>
 <li><strong>The affected wallets were bought through CryptoBilis, a reseller listed as authorized.</strong></li>
 <li><strong>Independent loss estimates remain unverified by Ledger.</strong></li>
 <li><strong>The genuine check validates the secure chip and cannot see added circuitry.</strong></li>
</ul>
<p><a href="https://x.com/Ledger_Support/status/2108968264055345381" rel="noopener noreferrer nofollow">Ledger confirmed on October 10</a> that a device belonging to an affected customer contained an unauthorized hardware implant, one day after the company opened an investigation into funds disappearing from wallets bought through CryptoBilis, a Southeast Asian reseller it listed as authorized. The company reported no indication that its own infrastructure or services had been compromised, which places the attack in the physical supply chain between the factory and the buyer. Blockchain analytics firm Bitquery puts the on-chain damage at roughly $92.9 million across 311 wallets, a figure Ledger has yet to verify.</p>
<h2 id="a-cellular-modem-beneath-the-screen-sends-the-recovery-phrase-to-the-attacker">A cellular modem beneath the screen sends the recovery phrase to the attacker</h2>
<p>Research published by Tibane Labs describes modified <a href="https://ethnews.com/guides/30-bitcoin-wallets-tested-hardware-online-mobile-and-paper-wallets/" rel="noopener noreferrer nofollow">Ledger Nano X</a> units carrying extra circuitry on the internal lines that feed the display. When a new owner sets up the wallet, the genuine secure element generates the recovery phrase and sends each word to the screen, and the implant reconstructs those words from the display data before a cellular modem with an eSIM and a custom antenna transmits them to the attacker. Nobody has to crack the chip, guess the PIN or trick the owner into signing anything, because whoever holds the phrase can rebuild the wallet on another device and wait for it to be funded.</p>
<p>Tibane Labs documented three generations of the hardware. The earliest used visible wires and a smaller replacement battery, later units moved to purpose-built flexible circuit boards, and the newest keeps the original battery while hiding the implant beneath the screen. The lab bought its specimens through Japanese marketplaces and states that it has established no link between them and CryptoBilis, while Ledger has yet to say whether every reported victim received the same design.</p>
<div style="margin: 28px 0; padding: 22px 18px 6px 18px; background: #f6f8fc; border-radius: 12px; border: 1px solid #e1e7f0;">
 <div style="font-size: 17px; font-weight: bold; color: #0b1f3a; margin-bottom: 18px;">
  From a Reddit warning to a confirmed implant
 </div>
 <div style="display: flex;">
  <div style="display: flex; flex-direction: column; align-items: center; width: 26px; flex-shrink: 0;">
   <div style="width: 16px; height: 16px; border-radius: 50%; background: #7b8aa3; border: 3px solid #dfe5ef; box-sizing: border-box;"></div>
   <div style="width: 3px; flex: 1; background: #cfd8e6;"></div>
  </div>
  <div style="padding: 0 0 20px 12px;">
   <div style="font-size: 13px; font-weight: bold; color: #7b8aa3; text-transform: uppercase; letter-spacing: 0.5px;">
    August 2025
   </div>
   <div style="font-size: 15px; color: #1c2738; margin-top: 3px;">
    A Reddit user warns about a suspicious Nano X
   </div>
  </div>
 </div>
 <div style="display: flex;">
  <div style="display: flex; flex-direction: column; align-items: center; width: 26px; flex-shrink: 0;">
   <div style="width: 16px; height: 16px; border-radius: 50%; background: #2f80ed; border: 3px solid #d5e6fc; box-sizing: border-box;"></div>
   <div style="width: 3px; flex: 1; background: #cfd8e6;"></div>
  </div>
  <div style="padding: 0 0 20px 12px;">
   <div style="font-size: 13px; font-weight: bold; color: #2f80ed; text-transform: uppercase; letter-spacing: 0.5px;">
    May 2026
   </div>
   <div style="font-size: 15px; color: #1c2738; margin-top: 3px;">
    Hardware researcher Joe Grand presents a reverse-engineered implanted wallet
   </div>
  </div>
 </div>
 <div style="display: flex;">
  <div style="display: flex; flex-direction: column; align-items: center; width: 26px; flex-shrink: 0;">
   <div style="width: 16px; height: 16px; border-radius: 50%; background: #8e44ad; border: 3px solid #ead9f2; box-sizing: border-box;"></div>
   <div style="width: 3px; flex: 1; background: #cfd8e6;"></div>
  </div>
  <div style="padding: 0 0 20px 12px;">
   <div style="font-size: 13px; font-weight: bold; color: #8e44ad; text-transform: uppercase; letter-spacing: 0.5px;">
    September 2026
   </div>
   <div style="font-size: 15px; color: #1c2738; margin-top: 3px;">
    Tibane Labs acquires two more modified devices through Japanese marketplaces
   </div>
  </div>
 </div>
 <div style="display: flex;">
  <div style="display: flex; flex-direction: column; align-items: center; width: 26px; flex-shrink: 0;">
   <div style="width: 16px; height: 16px; border-radius: 50%; background: #f39c12; border: 3px solid #fdebcc; box-sizing: border-box;"></div>
   <div style="width: 3px; flex: 1; background: #cfd8e6;"></div>
  </div>
  <div style="padding: 0 0 20px 12px;">
   <div style="font-size: 13px; font-weight: bold; color: #d98200; text-transform: uppercase; letter-spacing: 0.5px;">
    October 9, 2026
   </div>
   <div style="font-size: 15px; color: #1c2738; margin-top: 3px;">
    Ledger opens its investigation and asks CryptoBilis to halt sales and shipments
   </div>
  </div>
 </div>
 <div style="display: flex;">
  <div style="display: flex; flex-direction: column; align-items: center; width: 26px; flex-shrink: 0;">
   <div style="width: 16px; height: 16px; border-radius: 50%; background: #d93025; border: 3px solid #f9d6d3; box-sizing: border-box;"></div>
  </div>
  <div style="padding: 0 0 16px 12px;">
   <div style="font-size: 13px; font-weight: bold; color: #d93025; text-transform: uppercase; letter-spacing: 0.5px;">
    October 10, 2026
   </div>
   <div style="font-size: 15px; color: #1c2738; margin-top: 3px; font-weight: 600;">
    Ledger confirms an unauthorized implant in a customer’s device
   </div>
  </div>
 </div>
 <div style="font-size: 12px; color: #6b7686; padding-bottom: 12px;">
  Sources: Tibane Labs, Ledger
 </div>
</div>
<h2 id="the-genuine-check-clears-any-device-that-still-carries-its-original-chip">The genuine check clears any device that still carries its original chip</h2>
<p><a href="https://www.ledger.com/academy/topics/ledgersolutions/best-practices-to-securely-buy-ledger-signer" rel="noopener noreferrer nofollow">Ledger’s own security documentation</a> says the genuine check verifies the authenticity of the secure element, and the same documentation acknowledges that the test cannot necessarily identify physical modifications when the original chip stays in place. A wallet can therefore be electronically authentic while carrying a second, hostile circuit, and buying from an authorized reseller does nothing to close that gap.</p>
<div style="overflow-x: auto; margin: 28px 0;">
 <table style="width: 100%; min-width: 460px; border-collapse: separate; border-spacing: 0 8px; font-size: 15px;">
  <thead>
   <tr>
    <th style="padding: 12px 14px; text-align: left; background: #0b1f3a; color: #ffffff; border-radius: 8px 0 0 8px;">Protection</th>
    <th style="padding: 12px 14px; text-align: left; background: #0b1f3a; color: #ffffff;">What it establishes</th>
    <th style="padding: 12px 14px; text-align: center; background: #0b1f3a; color: #ffffff; border-radius: 0 8px 8px 0; white-space: nowrap;">Detects an implant</th>
   </tr>
  </thead>
  <tbody>
   <tr>
    <td style="padding: 13px 14px; background: #eaf6ef; border-left: 5px solid #1e9e5a; border-radius: 8px 0 0 8px; font-weight: bold; color: #14633a;">Genuine check</td>
    <td style="padding: 13px 14px; background: #eaf6ef; color: #1c2738;">The secure element is an authentic Ledger chip</td>
    <td style="padding: 13px 14px; background: #eaf6ef; border-radius: 0 8px 8px 0; text-align: center;"><span style="display: inline-block; padding: 4px 14px; border-radius: 20px; background: #d93025; color: #ffffff; font-size: 13px; font-weight: bold;">No</span></td>
   </tr>
   <tr>
    <td style="padding: 13px 14px; background: #e8f1fd; border-left: 5px solid #2f80ed; border-radius: 8px 0 0 8px; font-weight: bold; color: #1a56ad;">Secure element</td>
    <td style="padding: 13px 14px; background: #e8f1fd; color: #1c2738;">Private keys stay protected inside the chip</td>
    <td style="padding: 13px 14px; background: #e8f1fd; border-radius: 0 8px 8px 0; text-align: center;"><span style="display: inline-block; padding: 4px 14px; border-radius: 20px; background: #d93025; color: #ffffff; font-size: 13px; font-weight: bold;">No</span></td>
   </tr>
   <tr>
    <td style="padding: 13px 14px; background: #fdecea; border-left: 5px solid #d93025; border-radius: 8px 0 0 8px; font-weight: bold; color: #a3231a;">Supply-chain integrity</td>
    <td style="padding: 13px 14px; background: #fdecea; color: #1c2738;">Nobody modified the device before delivery</td>
    <td style="padding: 13px 14px; background: #fdecea; border-radius: 0 8px 8px 0; text-align: center;"><span style="display: inline-block; padding: 4px 14px; border-radius: 20px; background: #f39c12; color: #ffffff; font-size: 13px; font-weight: bold; white-space: nowrap;">No built-in test</span></td>
   </tr>
  </tbody>
 </table>
</div>
<p>Ownership of the reseller changed hands months before the thefts, according to former CryptoBilis co-founders Arravind Prabu and Vimalatheethan, who <a href="https://www.linkedin.com/feed/update/urn:li:activity:7514372792084152320/" rel="noopener noreferrer nofollow">said in a statement posted on LinkedIn</a> that new owners acquired the company earlier this year, that they completed the handover in March 2026 and that they have had no access to backend systems, customer databases or order histories since then. The two say they still advised the incoming management around industry events such as Bitcoin Pizza Day, without visibility into daily operations or IT infrastructure. Under the acquisition agreements all parties had to hold off on a joint public announcement until mid-October 2026, although the statement says suppliers were notified of the change, and the founders remain open to giving Ledger historical context for its review. They name Nicholas Chang as the current person in charge of CryptoBilis, and no public evidence ties him or the new owners to the implants.</p>
<h2 id="25-tron-wallets-emptied-within-three-seconds-suggest-a-single-operator">25 TRON wallets emptied within three seconds suggest a single operator</h2>
<p>Bitquery followed the stolen funds across TRON, Bitcoin, Ethereum, BNB Chain and Polygon, and the transaction pattern suggests one party holding a stockpile of recovery phrases. On TRON, 25 wallets were emptied within three seconds of each other, after roughly two weeks of small test transfers. More than 80% of the victim wallets received their first deposit from June 2026 onward, which hints at when the tampered units entered circulation, although a funding date does not prove a purchase date.</p>
<p>Part of the money is already out of reach, since Bitquery traced 1,254 ETH into the mixing protocol Tornado Cash on October 9, while Tether froze about $10 million in USDT held in suspected attacker wallets, a step that blocks the funds without returning them to victims. Other independent estimates of the total range from $86 million to $94 million. A teardown video circulating on X shows a disassembled unit with added circuitry, yet the claim attached to it that every wallet the reseller shipped was modified has not been established by Ledger or by the investigators.</p>
<blockquote class="twitter-tweet">
 <p>JUST IN: UP CLOSE VIDEO SHOWS HOW HACKERS STOLE OVER $80,000,000 SILENTLY CORRUPTING LEDGER <a href="https://x.com/hashtag/BITCOIN?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#BITCOIN</a> WALLETS</p>
 <p>A SCAM SHOP IN MALAYSIA WAS LISTED AS AN "OFFICIAL AUTHORIZED RESELLER FOR YEARS"</p>
 <p>BEHIND THE SCENES, CRIMINALS WERE INSERTING MICROSCOPIC SPY CHIPS ON EVERY WALLET</p>
 <p>THEY… <a href="https://t.co/aU9DfroWqJ" rel="noopener noreferrer nofollow">pic.twitter.com/aU9DfroWqJ</a></p>
 <p>— The Bitcoin Historian (@pete_rizzo_) <a href="https://x.com/pete_rizzo_/status/2109324397056340152?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">October 11, 2026</a></p>
</blockquote>
<h2 id="resetting-a-cryptobilis-device-leaves-an-already-captured-phrase-exposed">Resetting a CryptoBilis device leaves an already captured phrase exposed</h2>
<p>Ledger is advising customers who bought through CryptoBilis in the past 90 days to leave uninitialized devices untouched, and those who already set one up should move their assets to a wallet created with a completely new recovery phrase on trusted hardware. Resetting the suspect device or restoring the old phrase elsewhere changes nothing if the words have already been transmitted. Affected users should also expect unsolicited offers of recovery help, and no legitimate support agent will ask for a recovery phrase.</p>
<p>CryptoBilis has stopped selling <a href="https://ethnews.com/guides/top-5-safest-crypto-wallets/" rel="noopener noreferrer nofollow">hardware wallets</a>, and Ledger says it is contacting affected customers, cooperating with authorities and developing additional anti-tampering measures. Open questions include how many modified units remain in circulation, at which stage of distribution the implants were installed and who compensates buyers when an authorized channel delivers tampered hardware.</p>
<p>The implant case arrives less than two months after Ledger disclosed three flaws that also concerned what the wallet’s screen shows. On August 27 Ledger published three security bulletins, one covering <a href="https://donjon.ledger.com/lsb/023/" rel="noopener noreferrer nofollow">a Secure SDK flaw</a> that let a malicious host alter transaction parameters after they appeared on the display, and two covering Ethereum app bugs fixed in version 1.22.3, including one that showed a single operation while the signature authorized 257. Ledger reported no evidence that any of the three was exploited, whereas the October case comes with reported losses and no software patch that can remove a physical component.</p>
<p>The post <a href="https://ethnews.com/ledger-buyers-lost-millions-to-a-spy-chip-hidden-under-the-screen/" rel="noopener noreferrer nofollow">Ledger Buyers Lost Millions as Spy Chip Found Inside a Wallet</a> appeared first on <a href="https://ethnews.com" rel="noopener noreferrer nofollow">ETHNews</a>.</p>

Ledger Buyers Lost Millions as Spy Chip Found Inside a Wallet

Table of Contents

ETHNews

Other articles published on Oct 11, 2026

Join our free newsletter for daily crypto updates!