Securify

A sophisticated hardware supply-chain attack has drained an estimated $92.9 million in cryptocurrency from more than 300 wallets after hidden spy chips were discovered inside tampered Ledger hardware wallets. The attack, which Ledger confirmed on October 12, represents one of the largest physical supply-chain compromises in crypto history and raises urgent questions about the security of the hardware wallet distribution chain.

What Happened

On October 9, 2026, hundreds of cryptocurrency wallets linked to Ledger hardware signers began draining simultaneously. Within 47 minutes, funds disappeared across five blockchains: TRON, Bitcoin, Ethereum, BNB Chain, and Polygon. The scale was staggering — onchain analyst Bitquery traced $92.9 million in losses across 311 victim wallets.

TRON bore the heaviest losses at $70.5 million, mostly in USDT. Bitcoin victims lost 203.8 BTC (worth roughly $16.8 million), while Ethereum wallets lost about $3.7 million. Smaller amounts were taken from BNB Chain ($1.45 million) and Polygon ($580,000).

Within hours, Ledger traced every confirmed loss back to devices sold by CryptoBilis, a Malaysia-based hardware wallet retailer operating across Southeast Asia. The company immediately asked CryptoBilis to halt all sales and shipping.

Inside the Implant

When researchers cracked open the affected devices, they found something remarkable: a tiny, professionally manufactured spy module hidden inside the Ledger Nano X’s enclosure. The implant intercepted the device’s screen output through the OLED display’s SPI data bus, capturing the 24-word recovery phrase as it appeared on screen during initial wallet setup.

The captured seed phrase was then transmitted to the attackers over an LTE mobile network using a built-in eSIM — no Wi-Fi, no Bluetooth, no connection to the victim’s phone or computer required. The implant operated silently and independently.

Security firm Tibane Labs identified two distinct variants of the implant. The first version replaced the device’s original battery with a smaller one to make room for the spy module, which used an ST STM32G431KBU6 microcontroller (an Arm Cortex-M4 chip with 128 KB of flash memory), a 2×2 mm eSIM, and a shielded LTE module. The antenna was taped across the battery compartment. In some units, the chip markings had been scraped off to hinder identification.

The second, more advanced variant was even harder to detect. It fit entirely within the foam padding space beneath the OLED display, used the original battery for power, and ran its antenna along the top edge of the device. Mark Karpelès, former CEO of the Mt. Gox exchange and now head of Karpeles Lab, was among those who publicly dissected an implanted device.

Crucially, the implant did not modify the Ledger’s Secure Element — the tamper-resistant chip that stores private keys and runs cryptographic operations. Because the Secure Element was untouched, Ledger’s built-in “Genuine Check” verification passed without issue, giving victims no reason to suspect their device had been compromised.

How the Attackers Operated

Onchain forensics paint a picture of a methodical operation. Between September 25 and October 7, the attackers ran dozens of test transactions — 21 rehearsal loops on TRON, 20 on Ethereum — fine-tuning their drain infrastructure. A $3 test transfer on October 2 went to an address that would later receive approximately $36 million during the main event.

When the drain began on October 9, it moved fast. Analysis by Bitquery showed that 25 TRON wallets signed identical approval transactions within a three-second window, confirming that a single operator held all the compromised private keys simultaneously.

The attackers moved quickly to launder the proceeds. About $20 million in USDT was bridged from TRON to Ethereum via the USDT0 bridge in 40 equal-sized pieces, then swapped on UniswapX for roughly 7,994 ETH. Approximately 1,254 ETH was funneled through Tornado Cash in three batches within 40 minutes of drain addresses being published. Another $14.9 million was converted to USDD, a stablecoin that Tether cannot freeze. Funds also moved through Relay.link, HiFiSwap, and NEAR Intents.

Tether responded within two hours, freezing 37 addresses holding roughly $10 million in USDT. As of the latest reports, the 203.8 BTC had not moved, and about $79 million remained traceable onchain.

The Distribution Chain

Tibane researchers noted that the implant boards were panelised flex PCBs — the type ordered from a professional board house, not hand-soldered prototypes. This suggests an organized manufacturing effort.

Most victim wallets were relatively new. More than 80% had been first funded from June 2026 onward, and six in ten were funded within the 90-day window Ledger later flagged. One drained TRON wallet had received 33.5 million USDT since October 1 and distributed most of it to 29 addresses, suggesting at least one business treasury was among the victims.

Tampered units were reportedly sold at nearly half the retail price — a red flag in hindsight, but an effective lure. Some devices were listed on Amazon Japan by a China-based seller shipping from Malaysia, and others appeared on Yahoo! Auctions Japan. After the disclosure, MediaMarkt Saturn, one of Europe’s largest electronics retailers, also suspended Ledger sales after a German customer reported finding an implant, though Ledger has not confirmed tampering outside the CryptoBilis channel.

Takeaways and What to Watch

Ledger says it is working with law enforcement to identify the perpetrators. No arrests have been made, and no group has claimed responsibility. The company has issued clear advice: anyone holding a CryptoBilis-purchased device that has not been set up should not initialize it. Those who have already used one should immediately transfer all assets to a new Ledger signer and generate a fresh recovery phrase.

The incident exposes a fundamental tension in hardware wallet security. Ledger’s Genuine Check is designed to verify firmware and Secure Element integrity — but a physical implant that sits outside the Secure Element’s trust boundary bypasses that check entirely. Ledger says it is now reviewing its reseller controls and anti-tamper protections, and has invited the security research community to collaborate on better tamper detection and chain-of-custody practices.

For the broader crypto community, this is a wake-up call about supply-chain risk. Hardware wallets are trusted precisely because they keep private keys offline — but that guarantee means nothing if an unauthorized module is reading the screen and phoning home. The lesson is stark: buy only from authorized retailers and the manufacturer directly, be wary of steep discounts, and inspect physical packaging carefully. In the hardware wallet world, the cheapest deal may turn out to be the most expensive.