Ledger Spyware Reports Expand to Europe and South America After $86 Million Drain
Physical tampering reported in multiple regions
Reports of tampered Ledger hardware wallets have expanded beyond Southeast Asia to include cases in Europe and South America. These devices, which are physical tools used to keep cryptocurrency keys offline for safety, were allegedly fitted with spyware designed to steal user funds.
The issue gained widespread attention after users who bought devices from a Malaysia-based reseller, CryptoBilis, lost more than $86 million last week. Security experts found that physical implants inside the wallets could record a user's seed phrase—a series of words that acts as a master key—by reading the device's screen output.
Critical details of the security breach
- Over $86 million was drained from users linked to one specific reseller.
- Spyware implants can record seed phrases while remaining undetected by Ledger's official security check.
- Reports of tampered devices have now surfaced in Germany and the Philippines.
- Ledger has warned its distributors never to restock products that have been returned by customers.
Official response from Ledger and experts
Ledger confirmed that the incident on October 9 impacted a limited number of devices sold through CryptoBilis. The company stated it is reminding all authorized resellers to only source products through official channels. Former Mt. Gox CEO Mark Karpelès helped identify the spyware, noting that it can record screen data to capture sensitive backup phrases.
Despite the warnings, some users who dismantled their devices out of fear were told their units were clean. Karpelès has urged anyone with a compromised device to move their digital assets to a new, secure wallet immediately.
New reports from Europe and Asia
A user in Germany claimed to have found a spy implant in a device purchased directly from MediaMarkt, an official Ledger reseller. While this specific device did not appear to have stolen any funds yet, the user suggested the attackers might be waiting for more widespread use before activating the exploit.
In the Philippines, another user shared images of a device bought from LazMall that contained a manual coil antenna, which experts identified as an older style of spyware. These reports suggest the tampering may not be limited to a single region or reseller.
Status of the Malaysian reseller
Attention has also turned to CryptoBilis, the reseller at the center of the initial $86 million theft. The firm's former CEO, Arravind Prabu, stated that the company was acquired earlier this year and that he is no longer involved in its operations. He claimed that former employees are under a confidentiality agreement that prevented them from announcing the change in ownership.
Why this matters for crypto security
Hardware wallets are generally considered the safest way to store cryptocurrency because they keep private keys away from the internet. If the physical supply chain is compromised, it undermines the primary security benefit of these devices. This incident highlights the risks of purchasing hardware wallets from third-party resellers rather than directly from the manufacturer.
Information sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.
Related Posts
XRP records strongest weekly price gain since 2024 election period
