A Spy in Your Wallet: Tampered Ledgers Drain $80 Million
 |
| By Marija Matic |
For years, hardware wallets — physical crypto storage that kept your tokens offline and out of hackers’ hands — were the gold standard for self custody.
But the latest scams have challenged that notion.
Last month, it was Trezor that found itself in the hot seat.
Now, it’s Ledger. And this scam comes with a unique twist.
Over $80 million was taken from Ledger users last week across three major networks — Bitcoin, Ethereum and Tron. That’s according to Arkham and other on-chain data providers.
As of writing, however, only a small part of it has been recovered.
On-chain investigator YFarmX says Tether froze 10 million of its USDT stablecoins on the first day.
However, 15,475 ETH, 203 BTC and 10 million USDD remain out of reach.
Here’s the critical piece of information: The victims didn’t click a phishing link or type their seed into a fake site.
Their hardware wallets were compromised before they took them out of the box.
An Unexpected Hero
Mark Karpelès is the former head of Mt. Gox — a Bitcoin exchange that crashed hard in 2014 after the theft roughly 850,000 BTC was discovered. Under his watch.
In short, he wouldn’t have been on anyone’s shortlist for cybersecurity hero in this story.
And yet, that’s exactly the role he took on. Because he started to look into this issue before Ledger’s announcement.
Karpelès says he usually takes his wallets apart before putting any crypto on them. And when he bought Ledger devices in Southeast Asia and opened them up, he found extra hardware inside.
According to him, a tampered device gives itself away in two ways.
The first is an antenna connected by a single wire that stands out quite a bit.
The second is a shorter battery or a missing pad behind the screen, both changed to make room for the extra board.
Here’s how it all works …
The spyware watches the screen. When the device shows a new recovery phrase during setup, it copies the words and sends them to the attacker through a SIM card hidden inside the device.
It only connects to the mobile network once it has the seed, so it barely drains the battery and gives no sign that anything is wrong.
Other users have started tearing down their Ledgers as well to compare them.
The result?
Devices bought from Ledger’s official store came out clean.
Several bought from resellers didn’t.
Karpelès claims to have confirmed implants in the Nano X and the Flex models. He hasn’t checked the others, though there are no reports involving the Nano S so far.
As he puts it: “They either didn’t do the S because it’s too cramped, or we just haven’t found someone affected yet.”
What Ledger Says
According to Ledger’s investigation so far, it seems the affected devices were sold through CryptoBilis, its authorized reseller for Indonesia, Malaysia and the Philippines.
To be clear, Ledger has not accused CryptoBilis of tampering. And CryptoBilis hasn’t commented publicly.
So how the devices were compromised remains a mystery. Which is why Ledger has asked CryptoBilis to halt all sales and shipments.
If you bought a device from CryptoBilis in the past 90 days, Ledger says not to set it up.
If you already have, you should move your assets to a new hardware wallet with a new recovery phrase.
Southeast Asia Is Patient Zero
New reports today suggest CryptoBilis may not be the only compromised channel.
A crypto user named Johannes believes at least one European retailer, MediaMarkt, has also been affected.
He bought a Nano X there a couple of weeks ago, then bought a second one from a different MediaMarkt location and filmed the unboxing.
His photos show the same modifications: extra cables and an LTE module.
The discovery has convinced him the problem is more widespread than an isolated case with one reseller. It could potentially affect Ledger stock across MediaMarkt and Saturn, which run over 1,000 stores in 11 European countries.
But despite his request for Ledger to issue a recall, the company replied to his post pointing back to CryptoBilis.
It made no mention of European resellers:
Still, Ledger has reminded its distributors to source products only through authorized channels and has strictly prohibited restocking returns.
Finding the Mastermind
At this stage, we don’t know the source of the scam.
What we do know is that they are very well organized. Planting hardware at this scale, early enough in the chain to reach store shelves, takes serious money, technical skill and logistical planning.
The CryptoBilis side of the story adds another layer.
Binance founder CZ wrote: “What’s crazier is the hackers apparently bought the reseller and made them sign a non-disclosure agreement to keep their mouth shut.”
The previous owner of CryptoBilis has confirmed the company was sold, with the full handover completed in March 2026. Corporate and official registration records revealed that a Chinesenational is now listed as holding 100% of CryptoBilis' shares.
A Design Question for Ledger
Ledger has been one of my least favorite hardware wallets for a long time. That’s because this isn’t its first headline-generating vulnerability.
But this one raises a unique but basic question: Why were these devices not built so that this kind of tampering is impossible? Or at the very least make tampering obvious with transparent casing?
Because of the design, attackers didn’t need to change the outside.
They swapped in a smaller battery or removed the padding behind the screen, and the device looked and worked like a normal Ledger.
What to Do
So far, there are no confirmed cases in North America.
If you bought directly from Ledger, you should be fine. It’s the resellers that introduced the vulnerability.
So, if you bought a Ledger from anywhere other than the official Ledger store in the past 90 days, it’s time to live by the old crypto adage — verify, don’t trust.
If you see the spyware, chuck the device.
And if you already generated your seed phrase on it, you’ll want to get a new hardware wallet and move your balance over.
Don’t use the old seed again.
Best,
Marija Matić
