LEDGER JUST CONFIRMED A SPY CHIP INSIDE A USER'S WALLET 🚨 This is not FUD, this is Ledger itself saying it. On October 10, Ledger Support posted that "one of the impacted users' devices contained an unauthorized hardware implant." Photos shared on X and Threads appear to show a tiny circuit board tucked under the screen. Per reports, it allegedly reads whatever the screen shows, including the seed phrase during setup, and sends it out through an embedded SIM. Ledger has not confirmed exactly how the implant works yet. The affected devices trace back to CryptoBilis, a Southeast Asian reseller. Ledger first asked them on October 9 to pause Ledger sales, and CryptoBilis has now stopped selling all its hardware wallets while the investigation runs. Reported losses are around $86M across hundreds of wallets, but Ledger has NOT confirmed that number, and investigators have not proven the implant caused the thefts. Ledger says its own systems and services show no sign of compromise. This looks like a supply chain attack, meaning a tampered device sold through a third party, not a hack of Ledger's firmware. Ledger is working with law enforcement and building stronger anti-tamper protection. What you should do: Already using one = move funds to a new device with a fresh seed. Never share your 24 words with anyone, including "Ledger support." Buy hardware wallets only from the official store.

🚨 SAVING YOU TIME | CRYPTO 🔴 LEDGER: The attack may be larger than we thought! Analyst @Darkfost_Coc identifies over 20 suspected resellers. The full scope has not yet been confirmed. 🔴 COLDCARD: Following the $116 million hack linked to an entropy flaw, the manufacturer is facing another incident: a phishing link appeared on its official X account. Sources: PANews, TRM Labs, and Cointelegraph.

Approximately $91 million was stolen in a single sweep. 203 BTC were transferred into two addresses within the same block, and during the same hour, around $58 million in USDT on the Tron network was moved. The funds originated from a batch of Ledger hardware wallets—their recovery phrases had already been transmitted the moment users powered on their devices. Someone disassembled a Ledger purchased from Malaysia and found an additional small circuit board beneath the screen, equipped with an eSIM. On October 8, @MagicalTux posted photos of the disassembled device. The board contained an LTE module that remained dormant until activated—its sole function was to monitor the screen. As you powered on the device and manually entered each of the 24 recovery words, those words were transmitted over the cellular network. Ledger Live’s built-in authenticity verification could not detect this tampering—the Ledger chip inside was genuine; the malicious component was hidden beneath the screen. I examined those photos closely for a long time—the soldering was precise, unlike something from a makeshift workshop. In Malaysia, there is a hardware wallet retailer called CryptoBilis. Ledger’s official website has listed CryptoBilis as an authorized distributor in Malaysia, Indonesia, and the Philippines since at least 2022. It was a legitimate store, selling authentic products and operating honestly for years. But in March this year, the founding team sold the entire company. The sale included a non-disclosure agreement: original shareholders were prohibited from publicly disclosing the ownership change until October 19. By August, company registration records showed only one shareholder—named Jiaming—with a registered address in Heilongjiang. The store remained open, the website unchanged, the domain unaltered, and the “Authorized Ledger” sign still displayed in place. The former co-founder later revealed that the original team could no longer access the company’s backend systems. Then came the disassembly post on October 8—viewed 120,000 times. Just 22 hours after the post went live, the individuals holding those recovery phrases collected all the stolen funds. About seven hours after the transfers, Ledger finally announced it was investigating and requested CryptoBilis suspend sales and shipments. Yesterday, Ledger confirmed that affected users’ devices indeed contained unauthorized hardware implants. To date, no one has formally linked the new owners to the compromised devices, and Ledger has not disclosed how these boards were inserted into the units. But the path is clear: rather than cracking secure chips or reverse-engineering firmware, they simply bought an already-authorized brand name, riding on three years of built-up trust to ship devices that phoned home—waiting until the disassembly post went viral to drain all accounts in one sweep. The “Authorized Distributor” label originally belonged to the team that opened the store in 2022. The company changed hands in March, yet the sign remained unchanged—and no one has since re-verified who now controls it.

Ledger Confirms Hardware Implant Attack, Says Its Systems Were Not Breached Ledger said an unauthorized hardware implant was found inside an affected device, confirming physical tampering. The company said there is no evidence its own infrastructure, systems or services were compromised, while distributor CryptoBilis has suspended hardware wallet sales. Ledger advised affected users to avoid initializing unused devices and consider moving assets to wallets created with new recovery phrases. Earlier on-chain analysis estimated losses linked to the incident at more than $86 million.