The Mystery of the Stolen Ledger Hardware Wallets: Spy Modules Implanted, Dealer with Chinese Background Surfaces - 深潮TechFlow

An individual transferred 80 BTC into a newly purchased Ledger hardware wallet. Purchased from an officially authorized dealer, mnemonics hand-copied, secured in a safe. $5.2 million, everything done right.

Then the coins were gone.

On October 9, Ledger issued a statement confirming it is investigating asset losses for some users in Southeast Asia. All affected users one commonality: the devices were bought from a distributor called CryptoBilis.

Ledger directly ordered CryptoBilis to halt all sales and shipments, while warning users who purchased devices from this shop within the past 90 days: do not turn on units that haven't been powered on; for those with coins already stored, immediately transfer your assets to a new device using a fresh set of mnemonics.

How significant is this? On-chain analyst Specter tracked addresses reported by victims on X and , estimating involvement of approximately 98 wallets with losses exceeding $86.9 million. Another analyst, tanuki42, independently estimated losses over $72 million. Bitquery covered 311 wallets and provided a figure of approximately $92.9 million, distributed across three chains: Ethereum (approx. $42M), Bitcoin (approx. $17.6M), and USDT (approx. $16.5M).

These are estimates derived from on-chain tracking; Ledger has not confirmed final figures nor verified that all tracked addresses have a direct link to CryptoBilis. However, based solely on currently known information, this is already the largest recorded hardware wallet supply chain security incident in the crypto industry.

Distributor Quietly Changes Shareholders

CryptoBilis is no fly-by-night operation. It is listed on Ledger’s official website under their distributor page, explicitly stated as an "official authorized distributor," covering Malaysia, Indonesia, and the Philippines. Founded in Kuala Lumpur in 2020, it positions itself as "Southeast Asia's most trustworthy Web3 brand," selling not just Ledger but also Trezor, OneKey, Tangem, and SafePal.

User logic is simple: find this store on Ledger’s official website, buy a device from them, and the phrase "officially authorized" equates to a safety endorsement.

The problem lies in the fact that "official authorization" endorses selling rights, which is entirely different from supply chain security. Once devices leave the Ledger factory, they move through logistics, warehouses, and sorting facilities before reaching distributors and then consumers. At any point along this chain, devices could be intercepted, opened, and tampered with.

There is another more critical clue: CryptoBilis was acquired in March 2026.

Corporate records show that a person registered at an address in Heilongjiang Province, China, named "Jiaming," has held 100% equity in the company since August 3. The original founding team later stated that after the handover, they lost control of the company’s actual operations, declaring themselves "no longer part of the company," and calling on "current management to handle the matter transparently."

More intriguingly, the acquirer signed a non-disclosure agreement with former executives restricting them from publicly disclosing transaction details, valid until October 19. This means that when this incident erupted on October 9, former executives were legally barred from freely discussing the acquisition details.

Is there a causal link between the acquisition and the coin loss? There is no concrete evidence. But every coincidence in the timeline is making the question marks bolder.

What Was Hidden Inside the Device?

Ledger has not officially confirmed the specific mechanism of the attack to date, but individuals have already disassembled the devices.

Former Mt. Gox CEO Mark Karpelès claims he purchased a Ledger device from Malaysia and, upon disassembly, found a spy module containing a SIM card chip hidden inside. The module was concealed within the screen padding area, and the device's outer packaging remained intact with no visible anomalies.

SlowMist Chief Information Security Officer 23pds provided a more detailed technical analysis: attackers installed a microcontroller inside the device, connecting it to the screen’s SPI data lines. When users set up their wallets and the mnemonic words are displayed one by one on the screen, this module synchronously records every character output on the display. After recording is complete, it transmits the full mnemonic phrase to the attacker via built-in LTE or eSIM chips.

This attack vector works because it completely bypasses Ledger’s core defenses. Ledger’s Secure Element protects against direct reading of private keys, but it cannot control what is displayed on the screen. Those few seconds when the mnemonic words appear on the display constitute the attack window. Attackers don’t need to crack the chip; they just need to "peek at the screen."

This is not speculation. Mark Karpelès photographed the physical hardware, and 23pds provided the technical pathway. Although independent third parties have not yet verified these two analyses, they corroborate each other, pointing to the same conclusion: this was a meticulously planned hardware-level supply chain attack.

Beyond hardware implants, two other possibilities cannot be ruled out. One is the simplest and most crude form of preset mnemonics: attackers power on the device beforehand, set up the wallet, copy the mnemonics, repackage it, and when the user receives it believing they are "setting up a new device," they are actually using a word list already compromised by the attacker. The other is phishing: attackers obtain CryptoBilis’s customer database, impersonate Ledger officially sending emails or texts, and lure users into entering their mnemonics on a phishing website.

an hour after the news broke, CZ posted: "Based on the current information, this appears to be a supply chain attack limited to a single vendor. A small number of people may have purchased counterfeit or tampered Ledger devices." Meanwhile, he backed Ledger, stating it is "one of the safest and longest-established hardware wallets in the industry."

What Should Be Done Now?

Tether has already begun freezing some of the stolen USDT. However, decentralized assets like Bitcoin and Ethereum are virtually unrecoverable once transferred.

For CryptoBilis customers, Ledger’s advice is straightforward: for those who have already stored coins, treat the mnemonic as compromised and immediately transfer assets to a new device with a fresh set of mnemonics; for those whose devices have not been turned on, do not power them up.

For all hardware wallet users, this incident nails an old recommendation back to the wall: try to purchase devices directly from the manufacturer’s official website. "Officially authorized distributors" add a middle layer of brand trust, but that intermediary itself can become a potential attack surface.

A user summed up this dilemma perfectly in a discussion: “The entire point of a hardware wallet is that you don’t need to trust anyone, but now you have to trust that your distributor hasn’t tampered with your box.”

Join TechFlow official community to stay tuned

Telegram:

X (Twitter):

X (Twitter) EN: