# Ledger 'spy chip' attack: tampered wallets sent recovery phrases over LTE; up to $93 million stolen

Source: Searchable (https://searchable.pk/news/crypto/ledger-spy-chip-attack-tampered-wallets-sent-recovery-phrases-over-lte-up-to)
Type: News article
Author: Searchable Editorial
Published: 14 Oct 2026
Updated: 14 Oct 2026
Retrieved: 14 Oct 2026

> Ledger says implants hidden in signers sold by a Southeast Asian reseller read the 24 words off the screen and sent them to an attacker. How to check a hardware wallet you bought in Pakistan.

**Ledger has confirmed that some of its hardware wallets were fitted with a hidden "spy" implant that read users' 24-word recovery phrases and sent them to an attacker over a mobile network**, the company said on X on Tuesday, [CoinDesk reported](https://www.coindesk.com/tech/2026/10/13/ledger-says-spy-chip-inside-cryptobilis-ledger-devices-transmitted-wallet-keys-over-mobile-network). On-chain researchers estimate losses of **up to $93.2 million across more than 300 wallets**, roughly **Rs 25.8 billion** at today's [dollar rate](/data/usd-pkr). Ledger has not confirmed a figure.

## How the attack worked

Ledger calls it a **physical supply-chain attack**, not a hack of its software or systems:

- an extra circuit was hidden inside the device's casing;
- when the owner set the wallet up and the recovery phrase appeared on screen, the implant read the words;
- it sent them out over **LTE using an eSIM**.

The implant did not touch the secure element, the operating system or any transaction. It did not need to: anyone with the 24 words can rebuild the wallet on another device and empty it.

## Where the devices came from

Every confirmed loss in the incident that came to light on 9 October involved a signer sold by **CryptoBilis**, a Southeast Asian reseller, which has stopped selling Ledger devices. On Tuesday Ledger asked sellers in **Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong** to pause sales and pull stock, [Cointelegraph reported](https://cointelegraph.com/news/ledger-asks-resellers-to-halt-sales-in-southeast-asia-and-hong-kong). Ledger said "the only confirmed incidents remain contained to Southeast Asia" and that it has "no indication" its own systems or direct sales were compromised.

The worry is spreading: electronics chain **MediaMarkt Saturn** stopped selling Ledger devices after a customer in Germany reported finding an implant, and rival **Trezor** has cut back its resellers as a "preventative step". Tether has frozen $10 million in USDT linked to the theft.

## If you hold crypto in Pakistan

If your wallet came from a marketplace seller, a reseller or someone who brought it from abroad, rather than from the maker's own store, it travelled through the same kind of chain this attack used.

1. **Bought from CryptoBilis?** Do not set it up. If you already have, move your funds to a new wallet with a **newly generated** recovery phrase, as Ledger advises.
2. **Bought from anyone other than the maker?** Treat the device with suspicion. The safest course is a new device bought from the maker's own store and a fresh recovery phrase.
3. **Never use a phrase that came with the device**, printed on a card or already filled in. A genuine wallet always creates a new one in front of you.
4. **Opened box, broken seal or extra weight?** Do not use it.

Ledger chief executive **Pascal Gauthier** said the investigation is still working out "who tampered with these signers or where in the distribution chain it happened".

For today's prices, see our [bitcoin](/data/btc-usd) and [ether](/data/eth-usd) pages.

## Frequently asked questions

**Was Ledger hacked?**

Ledger says no: it calls this a physical supply-chain attack in which implants were added to devices sold by a reseller, CryptoBilis, and says its own systems and direct sales were not compromised.

**What should I do if I bought a Ledger from a reseller?**

Ledger advises CryptoBilis buyers not to initialise the device, and anyone who already used one to move funds to a new device with a newly generated recovery phrase.

## Sources

- Ledger says 'spy' chip inside CryptoBilis Ledger devices transmitted wallet keys over mobile network (CoinDesk): https://www.coindesk.com/tech/2026/10/13/ledger-says-spy-chip-inside-cryptobilis-ledger-devices-transmitted-wallet-keys-over-mobile-network
- Ledger asks resellers to halt sales in Southeast Asia and Hong Kong (Cointelegraph): https://cointelegraph.com/news/ledger-asks-resellers-to-halt-sales-in-southeast-asia-and-hong-kong

How to cite: "Ledger 'spy chip' attack: tampered wallets sent recovery phrases over LTE; up to $93 million stolen", Searchable, 14 Oct 2026, https://searchable.pk/news/crypto/ledger-spy-chip-attack-tampered-wallets-sent-recovery-phrases-over-lte-up-to