A spy under the screen: how Ledger wallets in Southeast Asia lost $93 million

On the morning of October 9, owners of Ledger hardware wallets in Indonesia, Malaysia and the Philippines opened the app and saw a zero balance. They had not sent anything, had not shared their seed phrase with anyone, and their devices were at home. By lunchtime, blockchain investigators had published the addresses the money went to, and within a few days it became clear what had happened: the seed phrases had leaked at the moment of setup, straight from the device screen. The wallets were emptied almost simultaneously, across six chains in 47 minutes. Below, we reconstruct the story from the first warning signs in September to Tether's freezes and look at what is known as of today, October 12, and what is still only a theory.

Warnings that came before the theft

The first signs appeared weeks before the money disappeared. Back in September, according to BleepingComputer, researchers were showing an implant inside a Ledger Nano X and noting that such devices were being sold for almost half the price of the original. One of them was Mark Karpelès, the former head of the Mt. Gox exchange. He bought his unit not from an official seller but on a well-known marketplace, from a Chinese seller who shipped it from Malaysia.

The finding was soon confirmed by the research studio Tibane Labs. It took apart two infected devices: one was bought on Amazon Japan from a China-based seller shipping from Malaysia, the other at Yahoo! Auctions in Japan. The two units contained two different versions of the implant, and the second was noticeably neater than the first. Tibane's key conclusion: the implant board was not hand-soldered but ordered from a manufacturer. That means the attack was not the work of a backyard workshop but a prepared, serial operation.

At the time, these findings looked like a story about counterfeits from marketplaces – the classic warning to buy only from official sellers. On October 9, it turned out that infected devices were being sold by an official reseller.

How the implant works

To understand why the attack worked, it helps to recall how a hardware wallet is built. The keys to the crypto are stored inside a protected chip, the Secure Element, and never leave it. The only moment the secret becomes visible is the first setup: the device shows the 24 words of the seed phrase on screen so the owner can write them down. That is the moment the implant was waiting for.

According to Tibane Labs, the attackers replaced the standard battery with a smaller one and used the freed space for an STM32 microcontroller, a 2×2 mm eSIM and a shielded LTE module. In the more advanced version, the implant fit where the foam padding under the screen normally sits and ran on the original battery. The microcontroller is connected to the lines that carry the image to the screen. It recognizes the Ledger font, detects that the setup screen is open, records the words one by one as the owner copies them, and sends the finished phrase to the attacker's server over the cellular network.

The worst part for owners is that such a device passes every check. Karpelès notes that his unit came in intact packaging and passed Ledger's built-in authenticity check, Genuine Check: nobody touched the real security chip, and the spy sits next to it. Ledger itself warns that Genuine Check does not detect implants if the original Secure Element is still in place. Only one detail could give the implant away – the antenna wire running along the top edge of the case. But to see it, you have to open the device.

The scheme has another property that explains the scale of the theft. The attacker did not need to empty the wallets right after setup. He could collect seed phrases for weeks, wait for owners to move their savings onto the devices, and take everything in a single strike.

The reseller that changed hands

All confirmed cases lead to one point – CryptoBilis, a hardware wallet store in Indonesia, Malaysia and the Philippines that was considered an official Ledger reseller. And the store turned out to have a story of its own.

Right after the first reports of thefts, the former founders of CryptoBilis, Arravind Prabu and Vimalatheethan, published a statement. According to them, the company had been bought by new owners earlier in the year, and in March 2026 they completed a full handover and have had no access to its systems, customer databases or order histories since. They could not announce the deal publicly: under the agreement, a joint announcement was barred until mid-October.

Corporate records cited by TechFlow show that since August 3, 100% of CryptoBilis shares have belonged to a Chinese national named Jiaming with a registered address in Heilongjiang province. The non-disclosure agreement, according to Prabu, runs until October 19. The thefts became public ten days earlier. The former founders name Nicholas Chang as the company's current head.

These coincidences were picked up by Binance founder Changpeng Zhao.

It is important not to confuse facts with theories here. The change of ownership is confirmed by documents. A link between the new owner and the implants is not: neither Ledger nor investigators have published such evidence. It also remains unclear where exactly the devices were opened: in the reseller's warehouse, at one of its suppliers or earlier. But the fact that an official sales channel operated for months under a new, undisclosed owner has already become the main question for Ledger's reseller system.

Two weeks of preparation and a 47-minute theft

The most detailed picture of what happened on-chain comes from the Bitquery investigation. It shows that the theft was planned in advance and carried out according to a script.

It all started on September 25. That day the attacker created two control addresses, one on TRON and one on Ethereum, three minutes apart. The gas for the TRON address came from a wallet that had withdrawn 14,512 TRX from the Bybit exchange the day before. For the next two weeks, both addresses rehearsed: they sent a wallet a few dollars and some gas, obtained a spending approval and pulled the money back. There were 21 such loops on TRON and 20 on Ethereum. The last two ran on October 7, 23 seconds apart.

On October 9 at 04:59 UTC, the script was launched. First, 30 TRON wallets changed their access settings within three seconds: each had the same new key added, strong enough to move the coins without the owner. Only the wallet's own key can make that change, so the attacker already held all 30 keys. Eight minutes later, 25 other TRON wallets signed the same spending approval in two consecutive blocks, and $29 million left them in six seconds. Almost at the same time, wallets on BNB Chain, Polygon and Ethereum were emptied, then on Solana, and at 05:54, 111 Bitcoin wallets were emptied in a single block.

Bitquery draws a clear conclusion from this: this is how software that already holds every key behaves, not a person. The company also tested the alternative theory of a phishing site collecting signatures from victims and rated it unlikely. One business wallet sent its entire balance, 4.3 million USDT, in the middle of the theft, which means the signature was made at that moment, without the owner's involvement.

In total, by Bitquery's count, the attacker took $93.2 million from 315 wallets. The main blow fell on TRON: $70.5 million, almost all of it in USDT. Bitcoin worth $16.8 million was taken, and the rest came from Ethereum, BNB Chain, Polygon and Solana. The victims were not only individuals: one of the emptied wallets had received 33.5 million USDT since October 1 and paid dozens of addresses, the way a business does. Other estimates are close but do not match: Specter, who was the first to publish the attacker's addresses, spoke of $86 million, while YFarmX counted $94.5 million from 521 addresses. Ledger has not given its own figure.

Bitquery also pointed to the timing. Ledger advises action for those who bought a device from CryptoBilis in the last 90 days. But more than eight in ten victim wallets first received funds from June onward. This means people who bought a device earlier may also be at risk.

The race with Tether: where the money went

As soon as the attacker's addresses became public, the race began. The first posts with the addresses appeared on X at around 12:00 UTC, and about ten minutes later Tether started blacklisting linked addresses. Over two hours it blacklisted 37 addresses, and $10 million in USDT remained stuck on 20 of them. Ledger issued an official statement at 13:32 UTC: the company announced an investigation, asked CryptoBilis to stop sales and advised buyers not to set up new devices.

The attacker had apparently prepared for the freezes. He moved most of the USDT on TRON out before the first posts: 20 million went to Ethereum through the USDT0 bridge and was swapped for ETH, and 14.9 million was converted into USDD, a TRON stablecoin that Tether cannot freeze. The rest went through the swap services Relay, Chainflip, HiFiSwap and NEAR Intents, which paid the attacker in ETH.

On the evening of October 9, the laundering began. Three batches of about 400 ETH each went into the Tornado Cash mixer within 40 minutes, and another 1,736 ETH followed the next day. In total, 2,990 ETH in two days. From the mixer, the coins went into Zcash, a network that can hide the sender, recipient and amount, and came back out. But the anonymity did not work: Bitquery matched the amounts and timing of deposits and withdrawals down to the smallest unit of Zcash and found five new wallets holding 5.35 million USDC. These can be frozen by the USDC issuer, Circle. Bitquery calls the link strong but stresses that after a mixer it rests on matching patterns, not direct proof.

The attacker tried to cash out part of the money through over-the-counter intermediaries. He swapped 5.1 million USDD back into USDT and sent it to the wallets of an OTC group, and from there 5.2 million USDT went to Binance deposit addresses. These wallets also serve other clients, so the attacker's exact share of these transfers cannot be established. But the exchange knows which accounts the money reached, and for investigators this is one of the most promising leads.

As of the morning of October 11, about $81 million remained traceable on-chain, according to Bitquery. The Bitcoin worth $16.8 million has not moved since the theft. The attacker's wallets held 15,500 ETH and 10 million USDD. The addresses used to drain the funds can be checked in the KYTme explorer:

This story shows well why stablecoins are the weakest point for a thief and the most convenient one for investigators. Their issuers can freeze USDT and USDC within minutes, which is exactly why the attacker's first move was to swap them into ETH and USDD. If you accept USDT from unknown senders, check whether the coins are linked to such addresses. We explained why this matters for ordinary sellers in our article on where dirty crypto comes from.

Europe: implants in devices from MediaMarkt?

While attention was focused on Southeast Asia, the story took an unexpected turn in Europe. An X user going by Johannes reported finding an implant in a Ledger Nano X bought at a German MediaMarkt store, an official Ledger partner. A day later he bought a second device at another store of the same chain, filmed the unboxing and, by his account, again found the same modifications: extra wires and an LTE module.

Johannes rules out the theory that returns were resold as new: a store employee confirmed the device was not a return, and returned Ledgers are sent back to the manufacturer. According to store records, the stock came from the distributor Aqipa GmbH, which operates across Europe. Johannes called on Ledger to recall its products and sent the second device to the company for analysis. According to him, no funds left the European device: either the implant did not work, or the attackers were waiting for more money to build up on the infected devices.

This claim has not been confirmed. Some observers doubt that the published photos show an implant at all, or even an original board. Ledger has not publicly responded to it, and in its October 11 update it still says that all confirmed cases are linked to CryptoBilis. The company also reminded resellers and distributors to source products only through official channels and not to put returned devices back on sale.

What Ledger says and what is known today

On October 10, Ledger confirmed the key fact: an unauthorized hardware implant was found in the device of one of the victims. On October 11, the company published an update: the number of affected devices is limited, all confirmed cases are linked to CryptoBilis, there are no signs that Ledger's own infrastructure was breached, and the company is working with law enforcement and reaching out to victims. CryptoBilis has stopped selling hardware wallets. Ledger has not yet commented on compensation for victims: it did not respond to a CoinDesk request.

The market reaction was out of proportion to the scale of a single reseller. According to Santiment, Ledger was mentioned on social media 837 times on October 9, about 12 times more than the usual weekday level, and interest held up all weekend.

If you separate what is verified from what is assumed, the picture today looks like this. One implant in a victim's device is confirmed, as is the fact that all known cases are linked to CryptoBilis. The blockchain confirms that the theft was carried out by a single actor who held the keys to every wallet, and that Tether froze $10 million. The amount of damage is an analysts' estimate, not Ledger's data. A link between the reseller's new owner and the implants and the cases in European stores remain theories for now, as does the idea that all the thefts were caused by implants.

What Ledger owners should do

If you bought a Ledger from CryptoBilis, Ledger advises not to start setting up a new device, and if you have already set it up, to create a wallet with a new seed phrase on a device bought directly from the manufacturer and move all funds there. Given Bitquery's data, this is worth doing even if the device was bought more than 90 days ago. Owners of TRON wallets should check their access settings in a blockchain explorer: an unfamiliar key among the owners means someone else controls the wallet.

If your wallet has already been emptied, warn everyone who regularly sends money to it. The attacker still knows the key, and Bitquery recorded a case in which 70,000 USDT that arrived at an already drained wallet the next day was taken by the attacker ten minutes later.

Other Ledger owners do not need to panic: devices bought directly from the manufacturer do not feature in this story. But the lesson applies to everyone. A hardware wallet protects the key from the internet, but not from whoever opened the box before you. That is why such devices should be bought only directly from the manufacturer, and you should never use a device that arrived with a seed phrase already written down or cost less than usual.