Ledger spy chip scandal raises fears over crypto wallet security

Paris-based Ledger is reviewing its reseller controls and anti-tampering protections after spyware planted in some wallets led to roughly $90 million in stolen crypto.

Ledger describes the thefts as a physical supply-chain attack, not a breach of its software or internal systems.

How the implant worked

In an investigation update on X, Ledger said a spy chip inside devices sold by Southeast Asian reseller CryptoBilis read users' 24-word recovery phrases off the screen and sent them over a mobile network using an eSIM.

Ledger said the implant did not touch the secure element or alter transactions.

In a post on X, Mt. Gox's former CEO Mark Karpelès said he found a spy implant in an unused Ledger Flex bought at Singapore's airport.

Related: Dave Ramsey's investing advice falls short, study finds

Buyer Ben Yorke bought it from the airport and identified Metapod as the retailer. Ledger says every confirmed loss so far traces to CryptoBilis devices, and it has not verified a theft involving a wallet bought elsewhere.

Retail fallout

Reports also surfaced of tampered devices bought from German retailer MediaMarkt. A MediaMarktSaturn spokesperson told Bloomberg the group has removed all of the manufacturer's products from its stores and online platforms.