A hidden hardware implant has exposed a serious security risk in the cryptocurrency wallet industry. Ledger confirmed that an examined device sold through the CryptoBilis reseller contained unauthorized hardware capable of capturing recovery phrases and transmitting them over a cellular network.
Blockchain intelligence firm Bitquery estimates that approximately $102 million in cryptocurrency was stolen from 324 wallets across six blockchains. The full scale of the incident and the amount of funds that can be recovered remain uncertain.
How the Hidden Spy Chip Worked
Ledger's Donjon security team examined a device containing an unauthorized hardware component designed to capture the 24-word recovery phrase displayed during setup.
The reported implant used a microcontroller to read and decode the words, then transmitted the information through an embedded SIM and LTE connection.
A recovery phrase gives access to a wallet's funds. Anyone who obtains it can potentially restore the wallet on another compatible device and transfer the assets without possessing the original hardware wallet.
Ledger said the implant did not modify the device's Secure Element, operating system or normal transaction-signing process. The findings point to a hardware supply-chain attack rather than a confirmed compromise of Ledger's core software or security chip.
$102 Million Stolen Across Six Blockchains
Bitquery's investigation traced the reported theft across six blockchains.
TRON accounted for the largest share, with approximately $79.3 million stolen. Bitcoin followed with $16.8 million, while Ethereum accounted for around $3.7 million.
The remaining losses included approximately $1.45 million on BNB Chain, $580,000 on Polygon and $250,000 on Solana.
The estimated total was approximately $102 million, based on October 9 prices. These figures represent estimated losses, not confirmed final amounts, and the investigation remains ongoing.
Investigators Found Signs of Preparation
Bitquery identified small test transactions on TRON and Ethereum before the major theft. The activity suggests that the suspected operator tested transaction procedures before moving larger amounts.
Unlock Full Analysis
You've reached the end of the preview. Join CoinBelieve to read the rest of this report and access exclusive crypto intelligence.