(https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap) (https://www.bleepstatic.com/js/redesign/bootstrap/css/bootstrap.min.css) (https://www.bleepstatic.com/css/redesign/main.css?v=12.03.25.1) (https://www.bleepstatic.com/css/redesign/home.css) (https://www.bleepstatic.com/css/redesign/news.css) (https://www.bleepstatic.com/js/redesign/jquery-3.5.1.min.js) (https://www.bleepstatic.com/js/redesign/jquery-migrate-1.4.1.min.js) (../../../../www.bleepstatic.com/favicon/bleeping.ico) (https://fonts.googleapis.com/) (https://www.bleepstatic.com/) (https://www.google-analytics.com/) (https://www.googletagmanager.com/) (https://securepubads.g.doubleclick.net/) (https://www.bleepstatic.com/icons/apple-touch-icon.png) Ledger confirms spy chip implant behind wallet crypto thefts (index.html) (https://www.bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets/) (https://www.bleepingcomputer.com/news/security/anthropic-takes-risky-ai-tests-offline-after-models-breach-govt-sites/) (https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/amp/) (Bleeping Computer's News) (https://www.bleepingcomputer.com/feed/) (../../../../a.pub.network/bleepingcomputer-com/cls.css) (https://www.bleepingcomputer.com/) (BleepingComputer.com logo) (https://www.facebook.com/BleepingComputer) (BleepingComputer Facebook page) (https://twitter.com/BleepinComputer) (BleepingComputer Twitter page) (https://infosec.exchange/@BleepingComputer) (BleepingComputer Mastodon profile) (https://www.bleepingcomputer.com/feed/) (RSS feed) (Search site) (partner-pub-0920899300397823:3529943228) (FORID:10) (UTF-8) (Search Site) (Login) (Sign up) (https://www.facebook.com/BleepingComputer) (https://twitter.com/BleepinComputer) (https://infosec.exchange/@BleepingComputer) (BleepingComputer Mastodon profile) (https://www.bleepingcomputer.com/feed/) (RSS feed) (partner-pub-0920899300397823:3529943228) (FORID:10) (UTF-8) (Search Site) (Login) (Sign up) (https://www.bleepingcomputer.com/) News (index.html#nfeatured) Featured (index.html#nlatest) Latest (https://www.bleepingcomputer.com/news/security/anthropic-takes-risky-ai-tests-offline-after-models-breach-govt-sites/) (Anthropic takes risky AI tests offline after models breach govt sites) Anthropic takes risky AI tests offline after models breach govt sites (https://www.bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets/) (Cyberattack shuts down refrigerators at French supermarkets) Cyberattack shuts down refrigerators at French supermarkets (https://www.bleepingcomputer.com/news/security/retail-giant-ahold-delhaize-takes-systems-offline-after-cyberattack/) (Retail giant Ahold Delhaize takes systems offline after cyberattack) Retail giant Ahold Delhaize takes systems offline after cyberattack (https://www.bleepingcomputer.com/news/security/cyber-exec-arrested-in-case-allegedly-tied-to-shinyhunters-hackers/) (Cyber exec arrested in case allegedly tied to ShinyHunters hackers) Cyber exec arrested in case allegedly tied to ShinyHunters hackers (https://www.bleepingcomputer.com/news/security/ghostscript-flaw-lets-hackers-hijack-servers-via-pdf-uploads/) (Ghostscript flaw lets hackers hijack servers via PDF uploads) Ghostscript flaw lets hackers hijack servers via PDF uploads (https://www.bleepingcomputer.com/news/security/anthropic-warns-self-replicating-ai-could-spread-to-your-smart-devices/) (Anthropic warns self-replicating AI could spread to your smart devices) Anthropic warns self-replicating AI could spread to your smart devices (https://www.bleepingcomputer.com/news/microsoft/microsoft-october-2026-patch-tuesday-fixes-1-411-flaws-3-zero-days/) (Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days) Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days (https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-windows-10-kb5126657-extended-security-update/) (Microsoft releases Windows 10 KB5126657 extended security update) Microsoft releases Windows 10 KB5126657 extended security update (https://www.bleepingcomputer.com/tutorials/) Tutorials (index.html#tlatest) Latest (index.html#popular) Popular (https://www.bleepingcomputer.com/tutorials/how-to-access-the-dark-web-using-the-tor-browser/) (How to access the Dark Web using the Tor Browser) How to access the Dark Web using the Tor Browser (https://www.bleepingcomputer.com/tutorials/how-to-enable-kernel-mode-hardware-enforced-stack-protection-in-windows-11/) (How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11) How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 (https://www.bleepingcomputer.com/tutorials/how-to-use-the-windows-registry-editor/) (How to use the Windows Registry Editor) How to use the Windows Registry Editor (https://www.bleepingcomputer.com/tutorials/how-to-backup-and-restore-the-windows-registry/) (How to backup and restore the Windows Registry) How to backup and restore the Windows Registry (https://www.bleepingcomputer.com/tutorials/how-to-start-windows-in-safe-mode/) (How to start Windows in Safe Mode) How to start Windows in Safe Mode (https://www.bleepingcomputer.com/tutorials/how-to-remove-a-trojan-virus-worm-or-malware/) (How to remove a Trojan, Virus, Worm, or other Malware) How to remove a Trojan, Virus, Worm, or other Malware (https://www.bleepingcomputer.com/tutorials/show-hidden-files-in-windows-7/) (How to show hidden files in Windows 7) How to show hidden files in Windows 7 (https://www.bleepingcomputer.com/tutorials/how-to-see-hidden-files-in-windows/) (How to see hidden files in Windows) How to see hidden files in Windows (https://www.bleepingcomputer.com/webinars/) Webinars (https://www.bleepingcomputer.com/download/) Downloads (index.html#dlatest) Latest (index.html#most) Most Downloaded (https://www.bleepingcomputer.com/download/qualys-browsercheck/) (Qualys BrowserCheck) Qualys BrowserCheck (https://www.bleepingcomputer.com/download/stopdecrypter/) (STOPDecrypter) STOPDecrypter (https://www.bleepingcomputer.com/download/auroradecrypter/) (AuroraDecrypter) AuroraDecrypter (https://www.bleepingcomputer.com/download/fileslockerdecrypter/) (FilesLockerDecrypter) FilesLockerDecrypter (https://www.bleepingcomputer.com/download/adwcleaner/) (AdwCleaner) AdwCleaner (https://www.bleepingcomputer.com/download/combofix/) (ComboFix) ComboFix (https://www.bleepingcomputer.com/download/rkill/) (RKill) RKill (https://www.bleepingcomputer.com/download/junkware-removal-tool/) (Junkware Removal Tool) Junkware Removal Tool (https://deals.bleepingcomputer.com/) Deals (index.html#dcategories) Categories (https://deals.bleepingcomputer.com/deals/elearning?utm_source=bleepingcomputer.com&utm_medium=dd_cat) (eLearning) eLearning (https://deals.bleepingcomputer.com/deals/certifications?utm_source=bleepingcomputer.com&utm_medium=dd_cat) (IT Certification Courses) IT Certification Courses (https://deals.bleepingcomputer.com/deals/gear-gadgets?utm_source=bleepingcomputer.com&utm_medium=dd_cat) (Gear & Gadgets) Gear + Gadgets (https://deals.bleepingcomputer.com/collections/tag-cyber-security?utm_source=bleepingcomputer.com&utm_medium=dd_cat) (Security) Security (https://www.bleepingcomputer.com/vpn/) VPNs (index.html#vpopular) Popular (https://www.bleepingcomputer.com/vpn/guides/best-vpn/) (Best VPNs) Best VPNs (https://www.bleepingcomputer.com/vpn/guides/change-ip-address/) (How to change IP address) How to change IP address (https://www.bleepingcomputer.com/vpn/guides/access-dark-web-safely/) (Access the dark web safely) Access the dark web safely (https://www.bleepingcomputer.com/vpn/guides/watch-youtube-tv-abroad-vpn/) (Best VPN for YouTube) Best VPN for YouTube (https://www.bleepingcomputer.com/forums/) Forums (index.html#) More (https://www.bleepingcomputer.com/virus-removal/) Virus Removal Guides (https://www.bleepingcomputer.com/startups/) Startup Database (https://www.bleepingcomputer.com/uninstall/) Uninstall Database (https://www.bleepingcomputer.com/glossary/) Glossary (https://www.bleepingcomputer.com/news-tip/) Send us a Tip! (https://www.bleepingcomputer.com/welcome-guide/) Welcome Guide (https://www.wiz.io/lp/ai-threat-readiness-playbook?utm_source=bleepingcomputer&utm_medium=display&utm_campaign=FY27Q2_INB_FORM_AI-Threat-Readiness-Playbook&sfcid=701Vh00000cnU0lIAE&utm_term=FY27Q3-bleepingcomputer-970x250-Oct&utm_content=AITR-Playbook) () (https://www.bleepingcomputer.com/) Home (https://www.bleepingcomputer.com/news/) News (https://www.bleepingcomputer.com/news/security/) Security Ledger confirms spy chip implant behind wallet crypto thefts Ledger confirms spy chip implant behind wallet crypto thefts By (https://www.bleepingcomputer.com/author/bill-toulas/) Bill Toulas October 12, 2026 12:27 PM (index.html#comments) 1 (Ledger confirms hardware wallet spy implant behind crypto thefts) Ledger has confirmed that some of its devices distributed through Southeast Asian reseller CryptoBilis were compromised with a hardware implant that drained users' cryptocurrency wallets. The company has been investigating reports of users losing funds from wallets purchased through CryptoBilis, a major Malaysia-based hardware wallet retailer operating across Southeast Asia. Some researchers have shown the implant in Ledger X since September 16, saying tampered devices were available for nearly half the price of the original hardware. Ledger wallets are physical devices designed to securely store the private keys that control cryptocurrency assets and authorize transactions. On October 9, Ledger said it had launched an investigation into user reports of cryptocurrency losses and asked CryptoBilis to stop selling and shipping Ledger devices. (https://x.com/Ledger_Support/status/2108551100613714002) (Ledger) The next day, the company confirmed hardware tampering on at least one device, though it’s still unclear exactly how or when the devices were tampered with. "Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant. Ledger is reaching out to impacted users as part of the ongoing investigation," Ledger said. The crypto wallet maker also noted that it was working with authorities to identify the perpetrator and bring them to justice. “[...]Ledger recommends users who purchased a Ledger device from this reseller to not initiate set up if they have not yet done so. If you have set up your Ledger device, consider moving assets to a new Ledger signer (with a new seed),” (https://x.com/ledger_support/status/2108968264055345381) warned Ledger . Yesterday, Ledger (https://x.com/Ledger/status/2109331538072494364) provided another update , confirming that all user reports of unexpected fund drains were linked to devices sold through CryptoBilis and describing the affected volume as “limited.” While the company did not disclose the type of devices compromised in this supply-chain attack, reports online talk about a spy implant in Ledger X devices that blends with the legitimate hardware. Mark Karpelès, currently leading Karpeles Lab Inc. and CTO at Shells.com, showed a picture of the new implant in Ledger X, saying that it was "quite an evolution" from previous versions featuring manually soldered wires. (Hardware implant inside Ledger X device) Hardware implant inside Ledger X device source: (https://x.com/MagicalTux/status/2100131628815405511) Mark Karpelès The former CEO of Mt. Gox said the implant was concealed behind the screen, but its antenna cable would have indicated that something was wrong. According to Karpelès, the malicious hardware captured the device's display output and button presses to identify the seed phrase, then transmitted it to the attacker over an LTE connection using an eSIM. "Ledger Nano X are used to store crypto. The spy implants are used to steal whatever crypto you store in those Ledger Nano X," (https://x.com/MagicalTux/status/2100131628815405511) Karpelès explained . Although the CEO did not name CryptoBilis as the vendor of the compromised LedgerX, he said the device was not purchased via Ledger's recommended channels but from "a well known platform via a Chinese seller (product shipped from Malaysia)." Tibane Labs, a cryptocurrency research and development studio, confirmed Karpelès' finding, adding that there were two implant versions for Ledger X. The researchers obtained two variants, one in a Ledger device bought on Amazon Japan from " China-based seller · shipped from Malaysia," the other purchased on Yahoo! Auctions, Japan. In a report over the weekend, Tibane Labs notes that the threat actor made room for the malicious circuitry by replacing the original battery with a smaller one, which powers both the implant and the Ledger X. "Under the battery and antenna sits an ST STM32G431KBU6 (Arm Cortex‑M4, 128 KB flash, UFQFPN‑32)," the researchers found inside one of the devices. For connectivity, the actor used "a tiny eSIM, an 8‑pad package just 2×2 mm, next to the MCU, and a shielded LTE module that sends the words out." In the second hardware wallet analyzed, (https://www.tibane.net/research/ledger-nano-x-implant) Tibane researchers found that markings on both the MCU (Microcontroller Unit) and the eSIM had been scraped off to hide the part numbers. The second variant, which appears to be the same one that Karpelès described, is more advanced. It ran on the original battery and fit into the space normally occupied by the foam padding under the OLED display. In both cases, the tell tale was the antenna wire, which ran along the top edge in the case of the second implant. In the first implant, the antenna is taped across the top of the battery and the shielded LTE module. (750) Hardware implant inside Ledger X source: (https://www.tibane.net/research/ledger-nano-x-implant) Tibane Labs The researchers warned that the specimen above used "a designed, panelised flex PCB, the kind ordered from a board house, not a hand-built one-off." Ledger is advising users to avoid purchasing from unauthorized resellers as they run an increased risk of getting counterfeit or modified devices. The company is also reminding its authorized resellers and distributors to get the products only through authorized channels and to avoid restocking returned products. Ledger provides a ‘Genuine Check’ mechanism to determine the authenticity of the device; however, it (https://support.ledger.com/article/4404382029329-zd) explicitly warns that it cannot detect added implants when the device’s original Secure Element remains intact. At this time, there’s no indication that any other Ledger resellers are shipping compromised wallets; however, the community’s trust in the resellers’ network has been compromised, with many now calling for its dismantling. (https://hubs.li/Q04x67m50) (article image) (https://hubs.li/Q04x67m50) Build your security blueprint for AI-powered attacks Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed. (https://hubs.li/Q04x67m50) Save your seat Related Articles: (https://www.bleepingcomputer.com/news/security/brevo-supply-chain-attack-injected-clickfix-scripts-on-customer-sites/) Brevo supply-chain attack injected ClickFix scripts on customer sites (https://www.bleepingcomputer.com/news/security/malcious-admin-menu-editor-pro-plugin-backdoors-1-500-wordpress-sites/) Malcious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites (https://www.bleepingcomputer.com/news/security/hackers-push-malicious-virtualizor-update-in-bgp-hijacking-attack/) Hackers push malicious Virtualizor update in BGP hijacking attack (https://www.bleepingcomputer.com/news/security/hackers-poison-arrayref-rust-crate-to-push-infostealer-malware/) Hackers poison arrayref Rust crate to push infostealer malware (https://www.bleepingcomputer.com/news/security/safepal-data-breach-impacts-39-798-customers-stolen-info-for-sale/) SafePal data breach impacts 39,798 customers, stolen info for sale (https://www.bleepingcomputer.com/tag/cryptocurrency/) CryptoCurrency (https://www.bleepingcomputer.com/tag/hardware-wallet/) Hardware Wallet (https://www.bleepingcomputer.com/tag/ledger/) Ledger (https://www.bleepingcomputer.com/tag/supply-chain/) Supply Chain (https://www.bleepingcomputer.com/tag/supply-chain-attack/) Supply Chain Attack (Email article) (Print article) (index.html#) (Bill Toulas profile page) (https://www.bleepingcomputer.com/author/bill-toulas/) (https://www.bleepingcomputer.com/author/bill-toulas/) Bill Toulas (mailto:bill.toulas@bleepingcomputer.com) (Email bill.toulas@bleepingcomputer.com) (https://twitter.com/billtoulas) (Open Author's twitter page) Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks. (https://www.bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets/) (Previous story) Previous Article (https://www.bleepingcomputer.com/news/security/anthropic-takes-risky-ai-tests-offline-after-models-breach-govt-sites/) Next Article (Next story) Comments (tubrazysj Photo) (https://www.bleepingcomputer.com/forums/u/1400173/tubrazysj/) tubrazysj - 2 hours ago (index.html#) (Report) (index.html#cid39625) (Link) A genuine-device verification check is not enough if a physical implant can bypass the user's security assumptions. Hardware wallet providers and distributors need robust anti-tampering controls, transparent incident reporting, and clear consumer remediation procedures. In crypto, security is not just a technical issue; it is also a matter of consumer protection and legal responsibility. Post a Comment (https://www.bleepingcomputer.com/posting-guidelines/) Community Rules You need to login in order to post a comment (Login) Not a member yet? (https://www.bleepingcomputer.com/forums/index.php?app=core&module=global§ion=register) Register Now You may also like: (https://www.adaptivesecurity.com/cybersecurity-awareness-month?utm_source=display_network&utm_medium=paid_display&utm_campaign=2026_10_display_banner_bleepingcomputer&utm_id=701Rd00000qUUqjIAG) () Popular Stories (https://www.bleepingcomputer.com/news/security/cyber-exec-arrested-in-case-allegedly-tied-to-shinyhunters-hackers/) (FBI) Cyber exec arrested in case allegedly tied to ShinyHunters hackers (https://www.bleepingcomputer.com/news/security/hacker-used-artex-ai-and-claude-agents-to-target-south-korean-banks/) (Robot Hacker) ARTEX AI, Claude agents used in cyberattacks on South Korean banks (https://www.bleepingcomputer.com/news/security/nippon-columbia-malware-incident-exposes-86-million-karaoke-fan-records/) (Big Echo) Nippon Columbia malware incident exposes 8.6 million karaoke fan records S ponsor Posts (https://www.kaseya.com/resource/cybersecurity-report-challenges-security-teams?utm_source=701Rp00000xjHCS&utm_medium=Online%20Advertising) (Backup Vault) Is your backup really out of reach? See what the latest attacks reveal. (https://info.varonis.com/en/state-of-data-security-report-2025?utm_source=bleepingcomputer&utm_medium=referral&utm_campaign=bleepingcomputer_referral&utm_content=article) (AI is a data-breach time bomb: Read the new report) AI is a data-breach time bomb: Read the new report (https://www.nudgesecurity.com/features/nudge-ai-agents?utm_medium=sponsored&utm_source=bleepingcomputer&utm_content=sponsored_article&utm_campaign=oauth&utm_term=nudge-ai-agents) (New OAuth risk analyst agent: Turn 45 minutes of manual review into 15 seconds.) New OAuth risk analyst agent: Turn 45 minutes of manual review into 15 seconds. (https://www.criminalip.io/?mtm_campaign=GovWare_2026&mtm_source=BleepingComputer&mtm_medium=press) (Move from visibility to action with AITEM, Criminal IP’s next evolution of ASM) Move from visibility to action with AITEM, Criminal IP’s next evolution of ASM (https://www.token.security/book-a-demo?utm_source=bleepingcomputer&utm_medium=3rd-party&utm_campaign=bleepingcomputer&utm_content=oct-9) (AWS saw a valid key and let the agent clear a production bucket. See how Token Security ties each agent to its owner and limits it to read-only access.) AWS saw a valid key and let the agent clear a production bucket. See how Token Security ties each agent to its owner and limits it to read-only access. (https://specopssoft.com/product/specops-password-auditor/?utm_source=bleepingcomputer&utm_medium=referral&utm_campaign=bleepingcomputer_referral_na&utm_content=article) (Overdue a password health-check? Audit your Active Directory for free) Overdue a password health-check? Audit your Active Directory for free Follow us: (https://www.facebook.com/BleepingComputer) (https://twitter.com/BleepinComputer) (https://infosec.exchange/@BleepingComputer) (BleepingComputer Mastodon profile) (https://www.youtube.com/user/BleepingComputer) (https://www.bleepingcomputer.com/feed/) Main Sections (https://www.bleepingcomputer.com/) News (https://www.bleepingcomputer.com/webinars/) Webinars (https://www.bleepingcomputer.com/vpn/) VPN Buyer Guides (https://www.bleepingcomputer.com/sysadmin/) SysAdmin Software Guides (https://www.bleepingcomputer.com/download/) Downloads (https://www.bleepingcomputer.com/virus-removal/) Virus Removal Guides (https://www.bleepingcomputer.com/tutorials/) Tutorials (https://www.bleepingcomputer.com/startups/) Startup Database (https://www.bleepingcomputer.com/uninstall/) Uninstall Database (https://www.bleepingcomputer.com/glossary/) Glossary Community (https://www.bleepingcomputer.com/forums/) Forums (https://www.bleepingcomputer.com/forum-rules/) Forum Rules (https://www.bleepingcomputer.com/forums/t/730914/the-bleepingcomputer-official-discord-chat-server-come-join-the-fun/) Chat Useful Resources (https://www.bleepingcomputer.com/welcome-guide/) Welcome Guide (https://www.bleepingcomputer.com/sitemap/) Sitemap Company (https://www.bleepingcomputer.com/about/) About BleepingComputer (https://www.bleepingcomputer.com/contact/) Contact Us (https://www.bleepingcomputer.com/news-tip/) Send us a Tip! (https://www.bleepingcomputer.com/advertise/) Advertising (https://www.bleepingcomputer.com/write-for-bleepingcomputer/) Write for BleepingComputer (https://www.bleepingcomputer.com/rss-feeds/) Social & Feeds (https://www.bleepingcomputer.com/changelog/) Changelog (https://www.bleepingcomputer.com/terms-of-use/) Terms of Use - (https://www.bleepingcomputer.com/privacy/) Privacy Policy - (https://www.bleepingcomputer.com/ethics-statement/) Ethics Statement - (https://www.bleepingcomputer.com/affiliate-disclosure/) Affiliate Disclosure Copyright @ 2003 - 2026 (https://www.bleepingcomputer.com/) Bleeping Computer® LLC - All Rights Reserved (index.html#) (Back to Top) (Close) Login Username (Enter login name) Password (Enter login passwod) (1) Remember Me (1) Sign in anonymously (880ea6a14ea49e853634fbdc5015a024) (Login) (Login) (https://www.bleepingcomputer.com/forums/index.php?app=core&module=global§ion=login&serviceClick=twitter&return=https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/) (Sign in with Twitter button) Sign in with Twitter Not a member yet? (Register account) (https://www.bleepingcomputer.com/forums/index.php?app=core&module=global§ion=register) Register Now (Close) (Times reported) Reporter Help us understand the problem. What is going on with this comment? (0) (Spam) Spam (Abusive or Harmful) Abusive or Harmful (Inappropriate content) Inappropriate content (Strong language) Strong language (Other) Other Read our (https://www.bleepingcomputer.com/posting-guidelines/) posting guidelinese to learn what content is prohibited. Submitting... (index.html#) (Submit) SUBMIT (../../../../www.bleepstatic.com/js/redesign/fancybox/jquery.fancybox.css) (../../../../www.bleepstatic.com/redesign/fontawesome6/css/fontawesome.min.css) (../../../../www.bleepstatic.com/redesign/fontawesome6/css/brands.min.css) (../../../../www.bleepstatic.com/redesign/fontawesome6/css/solid.min.css)