MediumII Cyber Warfare & Critical Infrastructure11 October 2026, Sunday
Ledger confirms LTE spy chips planted in wallets via a reseller chain
Ledger confirmed hardware tampering on at least one device on 10 October. On 11 October it said every complaint of drained funds traced back to devices sold through CryptoBilis, a Malaysia-based reseller. Loss estimates range from 71.5 to 86 million dollars and are unverified.
BleepingComputer reported on 12 October that the implant reads the device's screen output and keystrokes to capture the recovery phrase, the word sequence that generates the wallet's master key. It then sends the phrase to the attacker over an LTE network via an eSIM. Researchers say the implant has appeared in devices since 16 September and that tampered units sold for almost half the price of genuine ones. Of the 2 variants examined, one shrinks the battery to make room and the other fits into the foam cavity beneath the screen. Ledger's own authenticity check cannot detect the added implant as long as the secure element, the chip that stores the key, is left intact.
Gizmodo reported on 9 October that Ledger listed CryptoBilis as a reseller for Indonesia, Malaysia and the Philippines. The company asked the reseller to halt sales and shipments and advised anyone who bought a device from it in the past 90 days not to set it up. Unverified tracking by the blockchain analytics firm Arkham showed about 71.5 million dollars sitting in flagged addresses; an analyst estimate cited by Crypto Briefing puts the figure above 86 million dollars. Ledger has not accused the reseller of tampering, and it could not be verified whether the implant was fitted at the reseller or earlier. One unit examined had been bought on Amazon Japan from a China-based seller shipping from Malaysia.
Talay assessment
Bottom line
The attack targeted the physical device in the distribution chain rather than its software, and it bypassed the manufacturer's own authenticity check. That exposes the same weakness in any hardware whose provenance and authenticity checks look only at the main chip. The most likely path is for hardware wallet makers to narrow their authorised reseller networks and extend tamper detection to physical inspection.
Likely effects
- Trust in crypto custodyNegativeWeeks
The authenticity check's failure to catch the implant erodes trust in third-party reseller channels and speeds the shift to buying direct from the manufacturer.
- Hardware supply securityNegative1–6 months
Hardware added at the reseller or logistics stage raises the need for physical inspection of corporate devices too, beyond certificates of origin.
- TürkiyeNegativeWeeks
Crypto use is widespread in Türkiye and many devices are bought on online marketplaces, so the risk from unauthorised channels applies to Turkish users as well.
Possibilities, ranked
- 1Contained to one reseller55%
The investigation ties the implant to a single distribution channel, Ledger identifies affected users and the loss figure becomes clear.
Watch: A Ledger statement on the number of affected devices and the size of losses
- 2Cases surface in other channels35%
Implanted devices bought from other marketplaces turn up, revealing an organised supply-chain operation.
Watch: A report of an implanted device bought through a channel other than CryptoBilis
- 3Perpetrators are traced10%
Police in Malaysia or elsewhere identify the group that fitted the implants, and part of the funds is frozen.
Watch: A freezing announcement from Malaysian police or stablecoin issuers
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- Funds in flagged addresses▼ $71.5m
- Reseller markets affected▼ 3 countries