Ledger spyware fear spreads across Asia and Europe

Ledger hardware wallets sold through authorized resellers are now loaded with hidden spyware capable of stealing users’ recovery phrases, with alleged losses already exceeding $86 million.

What’s the scoop?

• Initial flights: On October 9, thefts were reported involving Ledgers sold by CryptoBilisan authorized reseller in Malaysia, Indonesia and the Philippines, triggering an investigation by Ledger. Ledger has confirmed at least one hardware implant. Investigator Specter estimates more than $86 million was stolen, while security agency Yfarmx estimates losses at $103 million, per Cointelegraph. Ledger did not verify either figure. CryptoBilis halted sales of hardware wallets, while Trezor and OneKey severed ties.

• How implants work: Implants read the 24 word recovery phrase off-screen during setup, then transmit it over a hidden cellular connection. They leave Ledger’s security chip intact, allowing the devices to appear authentic. The researchers identified three generations dating back to 2025, each more difficult to detect.

• More discoveries across Asia: Mark Karpelès, former CEO of Mt. Gox confirmed an implant in a Ledger Flex purchased at the Singapore airport, as well as an older version in photos from another user. Tibane Labs also examined compromised Nano X devices purchased through Yahoo Auctions Japan and Amazon Japan, the latter from a seller based in China and shipped from Malaysia. Neither purchase was linked to CryptoBilis.

• Europe joins the investigation: A German user I found implants in two Ledgers purchased at separate MediaMarkt stores, although Ledger says no funds were lost. MediaMarkt’s parent company has since cessation of Ledger international sales. Ledger is investigating reports beyond CryptoBilis but has not confirmed thefts elsewhere, saying its own systems and direct sales are not affected.