Ledger wallets with a spy board: what is documented about the hardware implant and how to buy devices safely

On 9 October 2026 Ledger opened an investigation into drained wallets in Southeast Asia, and on 10 October the company confirmed that at least one affected device contained an unauthorised hardware implant. Since then several research reports, purchase records and loss figures have appeared, some of which contradict each other. This post separates what is documented and asks what follows for buying security hardware. We made no measurements of our own, and everything rests on the sources below.

What the implant does

Two research reports describe it independently: the one from Grand Idea Studio (first published in spring) and the one from Tibane Labs. An extra board sits under the display. It carries a microcontroller, in one variant an ST STM32G431KBU6, plus an antenna, an LTE chip and an eSIM. It reads the screen content and the button presses and sends the recovery phrase over LTE to a server. According to Zetter the stolen phrases go to servers in a Hong Kong data centre managed by Alibaba, at least 90 implants were sending there in June, and the true number is probably higher.

The actual security chip stays untouched. That is why the "Genuine Check" which Ledger offers passes. It tests the real chip and does not see an additional board.

Five steps after the reports of Grand Idea Studio, Tibane Labs, BleepingComputer and Zetter. The implant bypasses the security chip by reading before it. (Quelle: BleepingComputer, 12 Oct 2026, and Zetter Zero Day, 14 Oct 2026)

How to recognise tampered goods

The first generation had hand-soldered wires visible on opening. Later variants use a laminated flex circuit, coated black, with part numbers scraped off and a smaller battery to make room. As the clearest tell Zetter names a thin antenna along the top edge of the board, which on the most advanced model carries the printed ID "AC-A2016-NANO-V1.1", a sign of series production. BleepingComputer adds as a further indicator that tampered devices were sold for about half the price. A weight test or a guide to opening the device appears in none of the sources we read.

The loss figures and why they differ

Three counts of the same case at different times. The Cointelegraph value is an investigator's estimate (Specter), and Ledger has not confirmed it. Wallets: 315 (Zetter) or 324 (heise). (Quelle: Help Net Security, heise online, Zetter Zero Day, Cointelegraph)

The three numbers are not contradictions between cases but growing counts. According to heise, Tether froze about 10 million dollars of USDT and the rest is at the attacker's disposal. No source gives the number of affected devices, and the wallet count refers to accounts. The large outflows came in early October according to heise, partly automated: 25 TRON wallets were approved within three seconds, and USDT worth 29 million dollars was gone after six seconds. Before that the attacker had tested with small transfers for about two weeks.

How the devices reached retail

Ledger names CryptoBilis, a retailer in Malaysia, Indonesia and the Philippines, as the source of all confirmed cases, and asked it on 9 October to stop selling. The reports name more routes: two Nano X from MediaMarkt stores in Germany, by one buyer's account from an Austrian intermediary and not from CryptoBilis, marketplace sellers on Lazada and Amazon, a Flex from a shop at Singapore airport and another from a vending machine. According to heise, MediaMarkt Saturn has stopped selling Ledger wallets for now. Ledger says its own systems and direct sales are not affected, and names retailers who sourced goods outside the channels or resold returns as a possible cause. Zetter reports that CryptoBilis changed owners in March without making it public. The same source says explicitly that there is no evidence that anyone at CryptoBilis is behind the implants.

The period is longer than Ledger's warning. Ledger advises not using devices bought from CryptoBilis in the last 90 days. According to heise, though, about 40 percent of the drained wallets received their first deposit more than 90 days ago, some as early as 2024 or 2025, and Grand Idea Studio showed a tampered device already in May. According to Help Net Security more than 80 percent of the wallets Bitquery traced received their first deposit in June or later. Both statements belong together: the window of the warning does not cover everything.

What follows for buying security hardware

This applies to hardware wallets but equally to security keys, smartcard readers and tokens that companies use.

Buy security hardware only directly from the manufacturer or through its list of authorised dealers. Marketplace sellers, airport shops and vending machines are not part of that. Ledger advises the same.
An unusually low price is a warning sign. BleepingComputer names it as an indicator.
Check packaging and device as far as possible. An extra antenna or scraped component numbers are features of the known variants, but no proof that an implant is absent.
Never generate a recovery phrase on a device whose origin is unclear. Anyone who used a device from an affected retailer follows Ledger's advice: do not initialise it, or move assets to a new device with a new phrase bought from the manufacturer.
Scammers exploit the incident. Ledger says it never asks for the recovery phrase, neither by call nor by message.

What forums say

The BleepingComputer report ran on Hacker News with 793 points and 510 comments (thread), Zetter's investigation with 129 points and 159 comments (thread). We did not evaluate the threads and report no statements from them. For the technology of the implants the reports of Grand Idea Studio and Tibane Labs are the reliable sources.

How we checked

On 16 October 2026 we read the reports of Help Net Security, heise, BleepingComputer and Zetter and set the numbers side by side. We did not read Ledger's own support page and the two research reports in full, and they are linked below. Discrepancies: Help Net Security and Tom's Hardware give 93 million dollars, heise and Zetter 102 million, each after Bitquery with a different cut-off date. Which models are affected is stated differently: BleepingComputer speaks of Ledger X, heise of several models, and Zetter names Nano X and two Flex, with the Stax findings unconfirmed according to Zetter.