Spyware on Ledger Devices: New Cases Worldwide

New instances of Ledger hardware wallet replacements with spy equipment installations have reportedly been identified in Asia, Europe, and South America.

Ledger users who purchased wallets from Malaysian reseller CryptoBilis lost more than $86 million last week. Former Mt. Gox CEO Mark Karpeles discovered that the spyware in Ledger devices was reading the screen output: it could record any seed phrase while remaining undetected by the Ledger Genuine Check. Ledger confirmed that the October 9 incident affected a "limited" number of devices from CryptoBilis. The company reminded resellers to purchase products only through official channels and not to restock with returned items.

User @0xJohannes_ stated that he unpacked a Ledger with a spy implant, purchased directly from the official German reseller MediaMarkt. The device did not transfer funds to the attacker: "Either it didn't work, or they were waiting for wider use of compromised devices." He also reported cases in Asia, South America, and now in Europe.

User @Us_Chan007 showed photos of the internals of a Ledger wallet from the official Philippine reseller LazMall. Karpeles noted that it contained an early version of the spyware in the form of a "manual coil antenna." He also helped identify spyware in the Ledger Stax model from user @wentrre, who also purchased from CryptoBilis. "Transfer assets as soon as possible from any seed phrase that touched this device," Karpeles wrote. Meanwhile, dozens of users disassembled their Ledgers out of caution, and Karpeles informed them that the devices were "clean." Attention also turned to former CryptoBilis CEO Aravind Prabu. On X, he stated that the company was acquired earlier this year, and he stepped away from all operations. According to him, the account is managed by a new team, and former employees signed a confidentiality agreement that prevented them from disclosing the change of ownership.