> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# Risky Bulletin: Spyware chip found in Ledger crypto-wallets
- URL: https://f4n6.co.uk/security-feed/risky-bulletin-spyware-chip-found-in-ledger-crypto-wallets/
- Published: 2026-10-14T15:14:27.000Z
- Updated: 2026-10-14T15:14:27.000Z
- Author: Jeff Davies
- Tags: #security-feed

## 1\. Executive summary

A hardware implant has been found soldered inside Ledger Nano X hardware wallets, positioned between the secure element and the display, where it captures screen output, decodes it against a character map, and transmits the result to a remote operator over a built-in modem and eSIM. Ledger has told customers who bought affected devices from Southeast Asian reseller CryptoBilis to discard and replace them and to move funds to new blockchain addresses. On-chain researchers put suspected losses above $93 million, while the primary source cites more than $86 million; both figures are single-sourced and unverified by Ledger. The risk to EMEA financial services is supply-chain, not remote exploitation: any wallet, custody device, or signing appliance procured through a reseller rather than the manufacturer's direct channel is now a candidate for physical tampering, and seed material recovered this way defeats every downstream control. No CVE, CVSS score, or CISA KEV entry applies to this item, and no MITRE ATT&CK profile is available for the actors involved.

## 2\. Regulatory framing

| Article                                                                 | Trigger (the fact in this item)                                                                                                                                                           | Practical impact                                                                                                                                                                                                                                                                |
| ----------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| DORA Art. 28: ICT third-party risk, general principles                  | Affected devices reached customers through a reseller (CryptoBilis) rather than the manufacturer's direct sales channel, and at least one implanted device was reported bought in Europe. | Firms holding crypto assets or signing keys on hardware wallets must be able to evidence which procurement channel each device came through, and must treat reseller-sourced hardware as a distinct third-party risk requiring contractual and technical controls.              |
| DORA Art. 30: key contractual provisions with ICT third-party providers | The reseller's ownership changed hands this year and the new owners were never disclosed to the previous owners or, on the reporting available, to customers.                             | Contracts covering hardware procurement should require notification of change of control, sub-contractor and reseller disclosure, and a right to audit the physical supply chain. Where that clause is absent, the firm cannot rely on the vendor to surface a tampering event. |
| NIS2 Art. 21(2)(d): supply chain security measures                      | The compromise occurred in the physical supply chain, between component manufacture and end customer, and was not detectable by software.                                                 | Entities in scope must extend supply chain security measures to hardware provenance, including serial number verification against the manufacturer and inspection on receipt.                                                                                                   |

No DORA incident-reporting article is engaged on the facts available: there is no confirmed compromise of an EMEA financial entity's own ICT systems in this item, only a product supply-chain compromise. If a client confirms that seed material or funds were lost through an affected device, DORA Art. 17, 18 and 19 and NIS2 Art. 23 become live at that point.

## 3\. Technical analysis & attack chain

The implant is a physical modification to the wallet, not a software compromise. The confirmed steps, as described by Tibane Labs and relayed by Ledger, are:

1. An add-on chip is soldered onto the device board between the cryptographically secure element that performs the signing operations and the OLED display.
2. The chip intercepts the data the secure element sends to the screen.
3. It matches the intercepted characters against a character map, reconstructing the displayed text. This is the step that captures the seed phrase when the user views or writes it down.
4. It transmits the reconstructed data to a remote attacker using a built-in modem and eSIM card.
5. The operator uses the recovered seed phrases to access the wallet and drain the associated blockchain addresses.

The implant sits on the display path, so it does not need to defeat the secure element's cryptography. It reads what the user is shown. That is why the standard Ledger assurance argument, that the seed never leaves the secure element, does not hold against this device: the seed is displayed to the user for backup, and the display path is where the implant lives.

Two hardware generations are described. The earlier implants, seen in devices from September of last year, used hand soldering and off-the-shelf components, and required replacing the original battery with a smaller one to make room in the casing. The current generation uses a laminated flex PCB painted to match the surrounding Ledger components, keeps the original battery, and gains space by removing some of the foam padding. Tibane Labs describes the current version as the most advanced implant it has seen, and states that with the case open and the screen in place the device looks like an ordinary Nano X: original battery, original board edges and buttons, a normal OLED. The only visible giveaway is a thin black antenna wire running along the top edge.

Scope as reported: Ledger states that all confirmed cases in the disclosed draining incident of 9 October 2026 involve devices sold through CryptoBilis, and that its own systems and direct sales channels were not affected. CryptoBilis has suspended all Ledger device sales and says it is cooperating. At least one user has reported the same implant in a wallet bought in Europe, and an isolated case has been reported in a Ledger Flex bought at Singapore Airport. It is not established whether the European device came from an EU-based manufacturing or distribution path or from a batch of Southeast Asian stock resold or moved into the EU to cover shortages.

Confidence and attribution. The implant's existence, its position on the display path, and its modem and eSIM capability rest on the Tibane Labs report as relayed by the primary source; Adverse Trace has not independently verified the hardware analysis. The loss figures are single-sourced and inconsistent between sources: the primary item states more than $86 million, Help Net Security cites on-chain researchers at more than $93 million. Neither figure is confirmed by Ledger. The claim that CryptoBilis was sold to an undisclosed Chinese company rests on unnamed online reporting and a statement by co-founder Arravind Prabu that he sold the company under an NDA; treat it as unconfirmed. No threat actor has been named, and no MITRE ATT&CK profile exists for any actor in this item, so there is no attribution to make. The link between the implant and the drained funds is asserted by the reporting, not proven in the material available.

## 4\. Mitigation & containment

P1, within 24 hours:

- Identify every hardware wallet in use or held in custody and record its procurement channel. Any device bought through CryptoBilis, or through any reseller rather than Ledger directly, is in scope for replacement. Ledger's instruction is to discard and replace, not to inspect and retain.
- For any device in that set, move all funds to new blockchain addresses generated on a device from a trusted channel, and treat every seed phrase ever displayed on the suspect device as compromised. Do not reuse those seeds on a replacement device.
- Inspect devices physically where the case can be opened without voiding a control you depend on. The reported giveaway is a thin black antenna wire along the top edge of the casing. Absence of that wire is not proof of cleanliness, because the implant is otherwise concealed.
- Check device serial numbers against Ledger's own records or support channel to confirm the device was manufactured and shipped through an authorised path.

P2, within 72 hours:

- Suspend procurement of hardware wallets through resellers and intermediaries. Buy direct from the manufacturer, or from a distributor the manufacturer names in writing.
- For institutional custody, verify that signing policy requires more than one approver and that no single device's seed can move funds alone. This limits the loss from any one implanted device.
- Review the procurement contracts covering hardware security devices for change-of-control notification, reseller disclosure, and audit rights, per DORA Art. 30\. Where those clauses are missing, record the gap and raise it with the vendor.

P3, within 7 days:

- Add physical inspection on receipt to the standard intake process for signing devices and any other tamper-sensitive hardware: check packaging integrity, check the serial number against the manufacturer, and open and photograph the board where the device design permits it.
- Extend the same intake check to other hardware security modules and signing appliances bought through distribution, since the technique is not specific to Ledger.
- Where a client confirms funds were moved from an affected device, escalate to the incident process and assess DORA Art. 17, 18 and 19 and NIS2 Art. 23 reporting against the confirmed facts.

## 5\. Indicators of compromise

No atomic indicators of compromise are available in the source material. No hashes, domains, IP addresses, file paths, or registry keys are given. The implant is hardware and the reporting provides no network infrastructure for the modem and eSIM, no character map, and no firmware artefacts.

The sources do describe observable behaviours and physical characteristics. These are listed separately below and are not machine-pivotable.

### Behavioural indicators

| behaviour                                                                                         | where to observe                                     | confidence                                               |
| ------------------------------------------------------------------------------------------------- | ---------------------------------------------------- | -------------------------------------------------------- |
| Thin black antenna wire running along the top edge of the casing                                  | Physical inspection of the opened device             | Single-sourced (Tibane Labs, via primary item)           |
| Foam padding removed from inside the casing to make room for the implant                          | Physical inspection of the opened device             | Single-sourced                                           |
| Laminated flex PCB painted to match surrounding Ledger components                                 | Physical inspection of the opened device             | Single-sourced                                           |
| Wallet funds moved to an address the user did not authorise, shortly after the seed was displayed | Blockchain monitoring and wallet transaction history | Single-sourced; link to the implant asserted, not proven |
| Device sold through CryptoBilis or another reseller rather than Ledger direct                     | Procurement and asset records                        | Corroborated by Ledger's statement and Help Net Security |

## 6\. Detection

Insufficient indicators to author detection rules. The source material contains no file hashes, command-line strings, mutex names, registry keys, scheduled-task names, or network artefacts. The implant is a physical hardware modification and produces no host or network telemetry that a YARA or Sigma rule could match. Detection for this item is physical inspection and procurement-record review, as set out in §4.

## 7\. Sources

- Risky Business, "Risky Bulletin: Spyware chip found in Ledger crypto-wallets", https://news.risky.biz/risky-bulletin-spyware-chip-found-in-ledger-crypto-wallets/, 2026-10-14
- Help Net Security, "Hidden implant in Ledger hardware wallets linked to $93M theft", https://www.helpnetsecurity.com/2026/10/12/ledger-wallets-compromised-via-hardware-implant/, 2026-10-12

Both sources relay the underlying Tibane Labs report and Ledger's public statements. Adverse Trace has not obtained the Tibane Labs report directly.

## 8\. Adverse Trace position

Adverse Trace assesses this as a supply-chain integrity incident with a narrow but severe blast radius. There is no CVE, no CVSS score, and no CISA KEV entry, because the compromise is physical and no software vulnerability is involved; severity for an affected client is determined entirely by whether they hold funds or signing keys on a device bought through CryptoBilis or another reseller. For clients who bought direct from Ledger, exposure is low on the facts available, though the reported European and Singapore cases mean we cannot yet rule out wider distribution. The loss figures and the ownership change at CryptoBilis are single-sourced and unconfirmed, and we are not treating the attribution of the implant to any named actor as established. We will track Ledger's investigation and any expansion of the affected serial number range, and we will update this advisory if a confirmed EMEA distribution path emerges. Clients who hold crypto assets on reseller-sourced hardware wallets should treat those seeds as compromised today rather than wait for that update.

---

[Read the original source →](https://news.risky.biz/risky-bulletin-spyware-chip-found-in-ledger-crypto-wallets/?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*