Tampered Ledgers: scammer loses 60 BTC as Ledger launches tamper-detecting Atom

Ledger tightened the rules for every reseller of its hardware wallets on 15 October, six days after buyers of tampered devices in Southeast Asia lost their crypto in one coordinated sweep. In a statement on its blog, the Paris-based company said a criminal group had fitted genuine Ledger signers with a hidden implant that captured the 24-word recovery phrase during setup, then put the units back on sale through resellers in the region, chiefly CryptoBilis. On-chain researchers estimate the Ledger hack at between $86 million and about $103 million. Ledger has not confirmed any total.

Two more developments landed the same day. Blockchain analytics firm Chainalysis showed that one of the largest single victims was a scam operator who lost 60.3 BTC. And Ledger used its Op3n event in Paris to unveil the Ledger Atom, an $849 signer that it says can detect an attempt to open its case before it reaches the buyer.

Ledger’s chip and software were not broken. The weak point was the shop shelf: the devices were opened and fitted with extra parts after they left Ledger, and the company’s own authenticity check cannot spot that kind of implant.

Ledger bans shelf displays and the resale of returned devices

The new reseller rules took effect immediately, according to Ledger’s 15 October post signed by “The Ledger Team”. A device returned by a customer can never be resold in any form. Resellers may no longer put Ledger products on shelves or displays: stock stays in the back and is handed over only at purchase. Shops must also report promptly any customer complaint about a product that looks unusual.

There was “no flaw in Ledger’s chip, operating system or servers”, the company wrote. It described the episode as an outside job that cost the attackers months and, by its account, millions of dollars: buying genuine devices, opening them, fitting the extra components, slipping them back into distribution, and building servers to collect seeds and drain and launder the funds.

“This was not a systemic supply chain attack; it was a localized distribution attack,” Ledger said, as quoted by CryptoPotato. Most outlets, including CoinDesk, The Block and BleepingComputer, have used the term supply-chain attack. The facts both sides agree on: the tampering happened after the devices left Ledger, and the victims bought them new from an authorized reseller.

The company is working with law enforcement and thanked SEAL 911, a volunteer security emergency group. It offered to share lessons with anyone who builds or sells hardware wallets and promised a fuller technical disclosure later. It is also working on “additional measures” at product level, with no detail and no timeline for devices already in use.

How the Ledger hack worked: a chip that read the seed off the screen

The attack did not break the Secure Element, the chip that stores a Ledger’s keys. It went around it. According to Ledger’s investigation update of 13 October, reported by CoinDesk, the implant captured the 24 words as the device displayed them during setup and sent them out over a mobile network through a provisioned eSIM.

Ledger’s security team, Donjon, said the implant did not modify the Secure Element, Ledger OS, transactions or signatures, and found no sign that Ledger’s own infrastructure had been compromised. In other words, every transaction the victims signed was genuine. The attackers did not need to touch them: once they held the recovery phrase, they could rebuild the wallets on hardware of their own and move the funds whenever they chose.

That explains why the drain came all at once. The seeds had been collected as buyers set up their devices; on the morning of 9 October the attackers used them together.

What researchers found inside the tampered units

According to BleepingComputer, which reported on 12 October that researchers had shown the implant since 16 September, the component sat hidden behind the screen and read both the display output and the button presses. Mark Karpelès, former chief executive of Mt. Gox, and Tibane Labs said the antenna cable was the main visible sign of tampering. The tampered units were sold by CryptoBilis at nearly half the usual price, according to the same report.

Tibane Labs described two variants, again via BleepingComputer. One came from a device bought on Amazon Japan from a China-based seller that shipped from Malaysia; the other from Yahoo Auctions Japan. The first variant swapped the battery for a smaller one to make room. The second kept the original battery and used the space normally taken by foam under the OLED screen. The parts included an STM32G431KBU6 microcontroller, a 2 x 2 mm eSIM and a shielded LTE module on a panelised flexible circuit board, which suggests professional manufacturing. The part markings had been scraped off on one unit. Karpelès said his device had not been bought through Ledger’s recommended channels.

Karpelès also said he found an implant in a Ledger Flex bought at Singapore airport. Ledger has not confirmed a link to the CryptoBilis cases, CoinDesk and The Block reported.

From the 9 October drain to the new rules

• 22 September: the scam operator later identified by Chainalysis moved funds to three addresses held on Ledger devices, according to Chainalysis as reported by CryptoSlate and Journal du Coin.
• 9 October: wallets are drained across six blockchains, according to Bitquery. Ledger Support says on X it is investigating losses reported by Southeast Asian users who bought from CryptoBilis and asks the reseller to pause sales and shipments (The Block).
• 10 October: Ledger confirms that one affected user’s device “contained an unauthorized hardware implant”.
• 11 October: Ledger says every drain report it has is linked to CryptoBilis devices and calls the affected volume “limited”.
• 13 October: Ledger publishes its technical findings; asks resellers and distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales; MediaMarktSaturn removes Ledger products from its stores and online shops after a customer in Germany reports an implant, with no loss of funds in that case.
• 15 October: Chainalysis publishes the scam-operator case; Ledger issues its full response, new reseller rules and the Atom launch.

CryptoBilis is listed as an official Ledger reseller in Indonesia, Malaysia and the Philippines, according to The Block. Ledger has linked the drained devices to sales by CryptoBilis; it has not accused the company or its staff of involvement. “We have not verified a drain linked to a device bought elsewhere,” Ledger said in its update, as reported by Bitcoin.com News on 14 October.

MediaMarktSaturn took the German report seriously enough to clear its shelves. “We take this incident very seriously,” a spokesperson told Cointelegraph, as quoted by Trending Topics; the retailer said it was in contact with the manufacturer. No analysis of that unit has been published.

Losses put at $86M to $103M by researchers; Ledger confirms none

Every loss figure in circulation comes from outside Ledger. On 13 October the company said those numbers “come from third parties and Ledger has not fully verified them”, The Block reported. The estimates grew as researchers traced more wallets:

The “$86M hack” in many headlines is Specter’s early estimate of the same 9 October drain, not a separate incident.

On Bitcoin, Bitquery counted 203.8 BTC taken from 122 wallets, most of it in a single block mined at 05:54 UTC on 9 October, Journal du Coin reported on 16 October. Those coins had not moved as of 15 October. Most of the value, though, sat on Tron. Bitquery’s 12 October breakdown put about $70.5M of the total on that chain, and Journal du Coin, citing Bitquery’s later figures, counts about $79M of USDT stolen there. Part was bridged to Ethereum through USDT0, part swapped into USDD, a Tron stablecoin that Tether cannot freeze, and the rest split across the Relay, Chainflip and THORChain routing services, the same report said. Tether froze about $10M of USDT tied to the theft, CoinDesk reported on 13 October. About 7,260 ETH went into the Tornado Cash mixer between 9 and 13 October, according to Journal du Coin.

The scammer who lost 60.3 BTC to the same implant

The strangest detail came from Chainalysis on 15 October. One of the largest single victims of the drain was itself a fraudster, who lost 60.3 BTC, worth about $4.8 million when the firm reported it, according to Cryptoast. Cointelegraph, Journal du Coin and CryptoSlate, citing the same Chainalysis post, give “more than 60” bitcoin. Journal du Coin calculates that this was roughly 30% of the bitcoin stolen that morning. At $82,100, the BTC price at 07:59 UTC on 16 October, 60.3 BTC is worth about $4.95 million.

The coins came from a “task scam”, a scheme in which victims are first paid small commissions to post fake sales and reviews online. “Then a ‘negative balance’ appeared, and they were told to add their own money in order to get paid,” Chainalysis wrote, as quoted by Cointelegraph.

On 22 September the operator split the proceeds across three addresses held on Ledger devices. On 9 October each of the three wallets was emptied in one transaction to a single address already flagged for stolen funds, CryptoSlate and Cryptoast reported. Where the scammer bought the devices is not known, Cryptoast noted, and the addresses have not been published in the coverage.

The implant did not pick its targets. It recorded whatever seed its device displayed, whoever owned it.

What Ledger says, and what it leaves out

Ledger’s own teams bought and opened retail devices in several markets, including Germany, and checked samples from its warehouses. Every unit examined was clean, the company said. Chief executive Pascal Gauthier said on X that the investigation was ongoing “to determine who tampered with these signers or where in the distribution chain it happened,” CoinDesk reported. He added that Ledger was “reviewing the controls that apply to our direct sales and to resellers, and we will share what we can.”

Chief technology officer Charles Guillemet wrote that “Ledger is reviewing its reseller controls and anti-tamper protections” (CoinDesk, 13 October). He also acknowledged a limit of the current line: the cryptographic attestation on existing devices cannot detect an extra component that watches the screen, CryptoSlate reported. Ledger’s Atom write-up says the same.

Still missing from Ledger’s account: how many customers lost money, how much, who the attackers are, where in the chain the devices were opened, and when sales will resume in the seven Asian markets. The 15 October post gives no victim count and no loss total.

Ledger Atom: an $849 signer built to show if it was opened

Ledger presented the Atom in Paris on 15 October. The Founders Edition costs $849 in the US, with a fully refundable $100 deposit, and €849 in Europe, according to CryptoPotato, Cryptoast and Journal du Coin. CryptoPotato, citing The Verge, said the standard price after launch will be $899. Reservations run through Ledger’s own site. Ledger’s announcement gives an estimated delivery in the second quarter of 2027, while its shop page lists summer 2027, CryptoPotato and Cryptoast reported.

The device pairs an Android environment for apps with a separate Secure Element running Ledger OS, which takes over the screen whenever a transaction needs approval. It has a 4G and 5G connection for data only, with no calls or SMS, according to CryptoSlate and CryptoPotato. Ledger’s announcement adds a hardware switch that cuts the camera and microphone, and the Solana Mobile Seeker app preinstalled on every unit.

The part that answers this month’s attack is an active shield around the secure zone. In Ledger’s security write-up, Guillemet said it is “designed to detect any attempt to touch, open, probe, or modify it before the device reaches you”. If it is triggered, “the Secure Element knows, and it reacts”, the post says, without detailing the reaction. According to CryptoPotato, the Secure Element and controller chips sit in an enclosure that detects drilling or opening, the device also notices if the display or back cover is removed, and each back cover is paired to one device. Cryptoast reports that the alert cannot be cleared.

The shield does not stop someone from opening the device. It makes the opening visible. Ledger says this design would have blocked the screen-reading implants, CryptoPotato reported, a claim no outside lab has yet tested. The Nano X, Flex, Stax and other current Ledger models do not have the shield.

Critics called the timing of the Atom launch poor

Protos ran its 15 October story under the headline “Ledger roasted over $849 device launch after $86M hack”, and quoted users on X who called it the “worst timing ever”; one said whoever approved it should be fired. CryptoSlate framed the launch the next day as Ledger asking customers to trust a new $849 device while criminals were compromising existing wallets.

The criticism has a practical side. The tamper detection Ledger says would have stopped these implants comes in an $849 product that ships next year. Owners of current models are waiting for product-level measures Ledger has not described.

Trezor and OneKey cut ties with CryptoBilis

Rival makers moved too. Trezor removed CryptoBilis from its reseller list as a precaution and is trimming its wider reseller network: shops notified under the plan lose their authorization on 1 January 2027 and get no new stock until then, according to The Block and Cointelegraph. No tampered Trezor has been reported.

OneKey revoked CryptoBilis and offers free replacements for devices bought through it between 1 March and 13 October 2026, whatever the model and whether or not they were activated, The Block reported. OneKey said none of its customers had lost funds.

Can a Ledger be hacked? Not the chip, in this case

A wallet (portefeuille froid) conserve hors ligne les clés privées qui contrôlent vos cryptos, sur un appareil dédié ou un support jamais connecté à internet, ce qui les met à l'abri des attaques en ligne.">hardware wallet is a cold wallet: it keeps the private keys on a dedicated chip that never exposes them to a computer or phone. Nothing in this attack broke that chip. The weak point was the moment of setup, when the device shows the recovery phrase on its screen so the owner can write it down. An added component that can read the screen gets the same 24 words, and those words can recreate the wallet anywhere.

Ledger’s Genuine Check, which confirms that a device runs authentic Ledger hardware and firmware, cannot catch such an implant when the original Secure Element is intact, according to Ledger guidance cited by BleepingComputer and Cryptoast. A tampered device passes the test.

How to buy and set up a hardware wallet safely after the implant attack

The usual advice is to buy from the manufacturer or an authorized reseller. In this case the devices came through an authorized reseller, so that step alone was not enough. The steps below combine Ledger’s guidance with general good practice.

1. Buy directly from the manufacturer where possible. Ledger advises buying on its own site or from an authorized reseller, Cryptoast reported, and warns against unauthorized resellers (BleepingComputer). Marketplaces and second-hand listings carry more risk: the two implanted units Tibane Labs studied came from Amazon Japan and Yahoo Auctions Japan.
2. If you bought a device from CryptoBilis in the last 90 days and have not set it up, do not set it up. If you already did, move your assets to a new signer with a new recovery phrase (Ledger, 9 and 13 October, via The Block, CoinDesk and Bitcoin.com News).
3. If you lost funds, contact law enforcement before opening the device, so it can be examined as evidence (Ledger Donjon, via The Block).
4. Check the packaging, and refuse any device that arrives already set up or with a recovery phrase printed or pre-filled. Generate the phrase on the device yourself.
5. Write the phrase on paper or metal and keep it offline; our guide to storing a seed phrase covers the options. An optional passphrase adds a second secret that a captured 24-word phrase alone does not reveal.
6. Send a small test amount first, and wait before moving larger sums.
7. Expect phishing riding on the news. Ledger “will never call you, message you directly or ask for your 24-word recovery phrase,” it told Bitcoin.com News.

Checking for an implant means opening the device, which Cryptoast calls risky; most owners should contact support instead. For the full process, see our step-by-step guide on how to set up a hardware wallet, and our Ledger Nano X review for the model’s features. Our guide to avoiding crypto scams lists the fake-support tricks that tend to follow incidents like this one.

Earlier Ledger incidents were leaks, phishing and bad code

Ledger has been targeted before, but not this way. In June 2020 an intruder accessed its e-commerce and marketing database, which Ledger disclosed in July. In December 2020 the names, addresses and phone numbers of about 272,000 buyers were published on a hacking forum, BleepingComputer reported. In June 2021 criminals used that list to mail fake “replacement” Nano X devices with a letter claiming a leak; the instructions asked victims to type their recovery phrase into software on the device, BleepingComputer reported at the time.

On 14 December 2023, an attacker who phished a former Ledger employee and took over their npm account published a malicious version of the Ledger Connect Kit software library used by decentralized apps. Ledger put the losses at about $600,000 and said it would fully compensate victims.

Those episodes involved stolen data, fake devices or tampered code. October 2026 is the first confirmed case of a physical implant inside genuine Ledger devices sold new by an authorized reseller.

What to watch next

Ledger has promised a fuller technical disclosure, with no date. Sales in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong remain suspended with no restart date, and MediaMarktSaturn has not said when Ledger products will return. Trezor’s reseller cuts take effect on 1 January 2027. Law enforcement and SEAL 911 are tracing the funds, including the 203.8 BTC that Bitquery said had not moved as of 15 October. The Atom Founders Edition is due to ship in 2027.