The Ledger 'Spy Chip' Attack: Is Your Hardware Wallet Still Safe?

The entire promise of a hardware wallet is that the secret never leaves the box. You generate your 24-word recovery phrase on a dedicated offline device, you keep it away from every internet-connected computer, and you stop worrying about phishing sites and exchange collapses. People who hold crypto this way did exactly what the security guides told them to do.

In October 2026, some of them were robbed anyway, by the device itself. As CoinDesk reported, Ledger confirmed that a hidden chip, sitting inside the enclosure of some of its wallets, quietly captured owners' recovery phrases and sent them out over a cellular connection. No phishing link, no malware, no leaked seed. Here is an honest account of what happened, who is exposed, and what it actually says about keeping your own keys.

What happened: Ledger confirms a hidden implant

In an investigation update, Ledger said covert hardware was found inside some devices and that the "spy chip sat inside the device enclosure." The affected units all trace back to one route: a Southeast Asian reseller called CryptoBilis. The scare widened when a German customer reported an implant and the retail chain MediaMarktSaturn pulled Ledger devices from its shelves, and when Mark Karpeles, the former Mt. Gox chief executive, said he found an implant in a Ledger Flex bought at Singapore Airport.

The crucial thing to hold onto is the line between what is confirmed and what is estimated, because most coverage blurs it.

What Ledger has confirmed: that a physical implant existed in some devices, that it captured recovery phrases, and that the attack did not touch its software.

What is only an estimate: the scale. Ledger has not confirmed how many people were hit or how much was taken. The widely repeated figure, up to roughly $93 million across more than 300 wallets, comes from on-chain researchers, not from Ledger. Separately, the stablecoin issuer Tether froze addresses tied to the theft, with on-chain researchers putting the frozen amount at about $10 million in USDT. Treat any precise number as provisional and attribute it to researchers, not the company.

How do you steal from a wallet that was never online?

This is the part that makes the attack so unsettling. The implant did not need the internet, your PIN or your computer. According to Ledger's account, a tiny microcontroller inside the case watched the device's own screen. When the wallet displayed your 24-word recovery phrase during setup, the chip recognised and decoded the words, then transmitted them out over LTE using an eSIM, a self-contained cellular radio baked into the implant. The attacker simply received your phrase and, from anywhere in the world, regenerated your keys and emptied the wallet.

Because the theft happens at setup, doing everything "right" afterwards does not help. The device stays offline, the firmware is genuine, the PIN is strong, and none of it matters, because the secret was copied the moment it appeared on the screen.

Was Ledger's software or Secure Element hacked?

No, and this is both reassuring and alarming. Ledger is explicit that the implant did not modify the Secure Element (the hardened chip that guards your keys), did not change the operating system, and did not alter transactions or signatures. The cryptography did its job. The betrayal was purely physical: a second, rogue piece of hardware smuggled into the case to spy on the legitimate one.

That distinction matters for how you protect yourself. The usual assurances, a genuine Secure Element, authentic firmware, a passing on-device authenticity check, all verify the chip and the software. They are not designed to reveal a passive implant quietly reading the screen. So the signal that actually tells you whether you are exposed is not a software check at all. It is where your device came from.

Is my Ledger safe? How to tell if you are affected

The single most useful question is not "did I update my firmware?" It is "where did I buy this device?"

• Bought directly from Ledger or an official, authorised seller: current reporting does not tie the thefts to that channel. Lower risk.
• Bought from CryptoBilis, a marketplace listing, or any unofficial reseller: treat the device as compromised and move your funds to a brand-new wallet now.
• Received a device you did not order, or one that arrived with the recovery sheet already filled in or the packaging pre-opened: never set it up. That is the classic tampered-device setup.

If you are in the second or third group, the safe move is blunt: set up a fresh wallet from a trusted source, generate a new recovery phrase on it, and transfer everything across, before checking whether your address is among those already drained. For the mechanics of doing that safely, see our guide to the best crypto wallets of 2026 and how to buy and hold crypto safely.

One more warning: scammers are already exploiting the panic. Fake "Ledger support" emails are circulating that ask you to enter your recovery phrase to "check if you are compromised." Ledger will never ask for your 24 words. Anyone who does is trying to rob you, which is the same class of physical and social threat we covered in crypto wallet data breaches and wrench attacks.

Is cold storage still safe? The uncomfortable answer

Predictably, some took this as proof that self-custody is a mistake and you are better off leaving coins on an exchange or in an ETF. That is the wrong lesson.

What this attack really shows is that self-custody does not remove risk, it swaps one kind of risk for another. Leave your crypto with a custodian and you take on counterparty risk: the chance it is hacked, goes bankrupt, freezes withdrawals or is compelled to hand your assets over. Hold it yourself and you shed all of that, but you take on supply-chain risk: the chance that the sealed device you trusted was tampered with before it reached you. Both are real. Neither is zero.

The grown-up defences are duller than "buy an ETF." Buy hardware wallets only from the manufacturer or an authorised seller, never a marketplace reseller. Check tamper-evidence on arrival. And for serious holdings, use a multisignature setup that spreads keys across more than one device from more than one vendor, so a single poisoned device cannot drain everything. This is the same conclusion we reached after the Coldcard firmware flaw earlier this year: the risk most people never think about is the integrity of the box itself.

It did not help the optics that, under pressure, Ledger chose this moment to unveil a plan to turn its hardware wallet into a smartphone-like device it is calling the Atom. Pitching a new, more connected product in the middle of a supply-chain scare struck many owners as tone-deaf. The question Ledger has to answer first is simpler and older: can it guarantee that the box it sells you is the box you actually receive?

Frequently asked questions

What is the Ledger spy chip attack?

It is a physical supply-chain attack in which some Ledger hardware wallets were shipped with a covert chip hidden inside the case. Ledger confirmed the implant read the owner's 24-word recovery phrase off the device screen and transmitted it over a mobile network, letting attackers steal the keys. Confirmed cases trace to devices sold by the reseller CryptoBilis.

Is my Ledger safe?

If you bought it directly from Ledger or an authorised seller, current reporting does not link that channel to the thefts, so your risk is lower. If you bought it from CryptoBilis or any unofficial reseller, or received an unsolicited device, treat it as compromised and move your funds to a new wallet.

How much was stolen in the Ledger attack?

On-chain researchers estimate up to about $93 million from more than 300 wallets, but Ledger has not confirmed any victim count or total. Treat the figure as a researcher estimate, not an official number. Tether froze addresses tied to the theft, which on-chain researchers put at about $10 million in USDT.

Was Ledger's software or Secure Element hacked?

No. Ledger says the implant did not modify the Secure Element, the operating system, or transactions. It was a separate rogue chip added to the hardware, so the attack is physical, not a software or server breach.

How does the spy chip steal your recovery phrase?

A microcontroller hidden in the case reads the 24-word recovery phrase when the wallet shows it on screen during setup, then sends the words out over a cellular (LTE) connection using a built-in eSIM. The attacker uses the phrase to regenerate your keys remotely.

What should I do if I bought a Ledger from CryptoBilis?

Assume the device and its recovery phrase are compromised. Set up a brand-new wallet from a trusted source, generate a fresh recovery phrase, and move all funds to it immediately. Do not enter your old phrase into anything, and ignore any "support" message asking for your 24 words.

Does this mean hardware wallets are not safe?

Not exactly. It means a hardware wallet's safety depends on the integrity of the device you receive. Self-custody trades an exchange's counterparty risk for supply-chain risk. Buying from official channels and using a multi-vendor multisignature setup for large holdings are the real defences.