Hardware crypto wallets found implanted with spy chips, $90M in losses reported

On October 10th, a handwritten notice appeared on the shuttered storefront of CryptoBilis in Kuala Lumpur: the Malaysian cryptocurrency retailer had closed its physical locations indefinitely. The closure came one day after customers began reporting that funds had vanished from their hardware wallets—devices specifically designed to keep digital assets safe by storing them offline, beyond the reach of internet-connected thieves. Within days, blockchain researchers had tallied the damage: over $90 million in losses.

The culprit was not a software vulnerability or a distant hacker exploiting code. Instead, someone had physically opened the wallets and installed hidden hardware inside them. On October 15th, Ledger SAS, the Paris-based manufacturer of the affected devices, confirmed that a "highly organised criminal group" had carried out the implants. The company acknowledged that while CryptoBilis appeared to be the primary point of compromise, reports of similar implants were surfacing in wallets purchased through other channels—a sign that the problem extended far beyond a single retailer.

The discovery struck at the heart of what cryptocurrency users believed to be their safest option. Hardware wallets had long been marketed as impregnable: they store the private keys needed to access digital money on a physical device that never connects to the internet. Yet over recent months, a cascade of breaches had begun to erode that confidence. A software flaw in cold wallets made by Coinkite Inc had led to the theft of an estimated $130 million in Bitcoin over the summer. Trezor, another cold-wallet manufacturer, had suffered a data breach through a shipping provider that exposed personal information of roughly 67,000 customers. Now came this: criminals physically tampering with the devices themselves.

Social media investigators and security researchers began reverse-engineering the implants to understand how they worked. The hidden hardware intercepted the passcodes displayed on the wallet's screen, then transmitted those private keys over cellular connections to the attackers. Once the hackers had the keys, they could access the cryptocurrency stored on other devices. The implants were sophisticated enough to bypass Ledger's built-in protection chip and evade standard security checks—at least until the theft had already occurred. "Protecting against one type of attack doesn't eliminate the others," said Aneirin Flynn, chief executive of cybersecurity firm FailSafe. The implication was stark: a device designed to be unhackable had been hacked at the physical level, before it ever reached the customer's hands.

Ben Yorke, a cryptocurrency industry worker based in Kuala Lumpur, had purchased a Ledger Flex at a shop in Singapore's Changi Airport. Before setting it up, he noticed something wrong: subtle markings on the side suggested someone had tried to pry the device open. He sent it to Mark Karpelès, a crypto researcher who now runs Tibane Labs and who had previously headed Mt. Gox, the digital exchange that suffered one of the industry's most catastrophic hacks. Karpelès examined the device and found a custom connector tapping into the display, along with a cellular chip and SIM card. The sophistication of the work startled him. "This is not your guy in a garage putting implants on a Ledger," he told Bloomberg. "This is the kind of scale you see in spy movies."

The breach exposed a vulnerability that extended beyond any single company or product line. Ledger manufactures multiple wallet models with different designs, and older versions like the Nano X sometimes end up with third-party resellers who refurbish and resell them. The supply chain—the path from manufacturer to retailer to customer—had become a weak point. Esme Pau, head of capital markets and policy at blockchain security firm CertiK, framed the problem in operational terms: "Real-world security depends on the entire process." It was no longer enough to have unbreakable cryptography if the physical devices could be compromised before they left the factory or warehouse.

Ledger said it was investigating the breach in coordination with local law enforcement and would release more details as they became available. CryptoBilis did not respond to requests for comment. The full scope of the problem remained unclear—how many devices had been implanted, how many retailers had been compromised, whether the criminal group was still active. What was clear was that the devices marketed as the safest way to store cryptocurrency had proven vulnerable to a threat that no amount of encryption could prevent: someone with physical access and criminal intent.