Ledger halts CryptoBillis sales as suspected spy implant in wallets is tied to $86 million in crypto thefts
Ledger has asked reseller CryptoBillis to pause all wallet sales while it investigates reports that user accounts were drained. Photos and videos appear to show a hidden circuit board under the screen that may capture seed passphrases; more than $86 million is reported stolen.
Photos and videos posted on X and Threads appear to show a small circuit board sandwiched beneath the screen of affected wallets. The implant allegedly intercepts anything displayed on that screen, including the seed passphrase shown during the initial setup of the device. Using an embedded SIM card, the implant then sends that information back to the attacker, who can use it to siphon funds from the user's accounts.
There is no indication that Ledger's own systems have been compromised, or that wallets purchased directly from the company have been affected. The problem instead appears to be a supply chain attack, primarily involving users in Southeast Asia and the reseller CryptoBillis.
Ledger said it has provided guidance on how to check whether a wallet has been tampered with, and it asked CryptoBillis to halt sales of its wallets for the duration of the investigation.
The reports described by The Verge are based on user accounts and images circulating on social media, and the suspected implant has not been independently verified. Ledger's public statements so far address the reseller channel rather than the security of its own distribution or manufacturing.