Ledger says spy chip inside CryptoBilis devices stole wallet recovery phrases
How the spy chip worked
Ledger has released its first public account of a covert hardware implant found in some Ledger Stax devices sold by Southeast Asian reseller CryptoBilis. The attack targeted the device's screen, not the wallet's internal security systems.
A tiny chip hidden inside the device enclosure used a microcontroller to read the 24-word recovery phrase as it appeared on the screen. The implant then sent those words to attackers over an LTE mobile network using an embedded SIM, or eSIM.
The recovery phrase acts as a master key for a crypto wallet. Whoever has those 24 words can recreate the wallet on any device and move the funds — no matter what happens to the original Ledger hardware.
Supply-chain attack, not a software breach
Ledger stressed that this was a physical supply-chain attack, not a hack of its software or internal systems. The company said the implant did not touch the device's secure element, the chip designed to protect private keys, nor did it alter transactions or signatures.
Ledger confirmed that at least one signer contained an unauthorized implant, and all confirmed losses in the October 9 incident involved devices sold by CryptoBilis.
What is known about losses
Ledger has not confirmed the total number of victims or the full value stolen. Onchain researchers, however, estimated that more than 300 wallets were affected, with losses reaching up to $93.2 million. Tether, the issuer of the dollar-pegged stablecoin USDT, froze approximately $10 million in funds tied to the theft.
What Ledger is asking customers to do
CryptoBilis has stopped selling Ledger signers. Ledger told customers who bought a device from the reseller not to set it up. Anyone who has already initialized a CryptoBilis device should move their assets to a new device and generate a fresh recovery phrase immediately.
What remains unclear
Ledger said it has not verified thefts involving signers purchased outside CryptoBilis, though it is examining reports of implants in other devices and locations. The total number of affected users and the full scale of the operation remain unconfirmed.
Where this was reported
The details come from Ledger's official investigation update posted on X and reported by CoinDesk.
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.