Log inGet started free

Ledger Spy Chip Case: How to Buy a Hardware Wallet Safely

22 October 2026

This week's biggest security story for wallet users is not a smart contract bug. It is a physical attack on hardware wallets. The case shows that where you buy a device matters as much as which brand you pick.

What happened

Ledger confirmed that some of its devices sold through the Southeast Asian reseller CryptoBilis were compromised with a hardware implant that drained users' wallets. On October 9, Ledger said it had opened an investigation and asked CryptoBilis to stop selling and shipping Ledger devices.

The size of the loss is still unclear. Onchain researchers estimate the breach drained up to $93.2 million across 300 wallets. Other reports put the losses at around $86 million. Ledger has not confirmed any figure.

How the attack worked

Ledger described this as a supply-chain attack. The company called it a physical attack, not a breach of its software or internal systems.

When a user set up the device and the screen showed the recovery phrase, a microcontroller inside recognised the words and sent them over LTE using an eSIM. The recovery phrase is the master key to a wallet. Anyone who has it can recreate the wallet elsewhere and move the funds without the physical device.

Early reports described the method differently. One said attackers replaced the printed instructions with pre-generated seed phrases. Ledger said it is still unclear exactly how or when the devices were tampered with. Treat the details as developing.

Some warning signs were public. Researchers said tampered devices were on sale for nearly half the price of the original hardware.

What this does and does not mean

This is not proof that hardware wallets are broken. Reports say the findings do not point to a flaw in hardware wallets as a whole. Ledger's own Secure Element was not compromised, but the reseller network created a weak point that attackers used. Hardware sold directly by Ledger is so far unaffected.

Still, the risk is real for anyone who buys from third parties. Researcher Mark Karpelès found one hacked wallet that came through Amazon Japan, bought from a Chinese seller and shipped from Malaysia.

The industry has reacted:

  • Ledger halted distribution through resellers in seven Asian markets, and the European retailer MediaMarkt also stopped sales.
  • Rival maker Trezor wound up its reseller program as a precaution.
  • OneKey is reviewing its dealer network.
  • Tether froze about $10 million in USDT linked to the theft.

What is still unverified

Binance founder Changpeng Zhao claimed the attackers bought the reseller, but neither Ledger nor CryptoBilis has confirmed this. We do not repeat it as fact.

Zhao also suggested a waiting period for new devices. He recommends waiting at least two weeks before trusting a new hardware wallet with substantial funds. This is one person's advice, not an official standard. It is a reasonable extra layer, because a compromised batch may show its first thefts within that time, so analysts can raise the alarm.

What to do

If you bought a Ledger from CryptoBilis:

  1. Ledger recommends not starting setup if you have not done so yet.
  2. If you already set up the device, consider moving assets to a new Ledger signer with a new seed.
  3. If you think your device was modified, check Ledger's inspection guidelines and mail suspect units back to the company.
  4. Contact Ledger Support through official channels and file a complaint with local law enforcement.

For everyone else:

  1. Buy direct. Use the maker's official website. Ledger strongly advises against buying from unauthorised resellers, where counterfeit or modified devices are a risk.
  2. Be suspicious of big discounts. A price far below the official one is a warning sign, as the CryptoBilis case showed.
  3. Inspect the package. Check seals and contents against the maker's guidance. Do not use a device that arrives pre-set up or with a recovery phrase already printed.
  4. Create the seed yourself. Generate it on the device during setup, then write it down offline. Never type it into a phone, computer or website.
  5. Start small and wait. Send a small test amount first. Consider holding off on larger transfers for a couple of weeks, and watch for security news about your model.
  6. Keep software and devices updated. Download apps only from official sources.
  7. Follow your local laws. Keep records you may need for tax reporting, and use official channels if you must report a loss.

The lesson is simple. Hardware wallets remove the need to trust an exchange with your keys, but they do not remove every security risk. Self-custody works best when you also control where the device comes from.

Sources

This article is for information only and is not financial advice.