Ledger halts sales after spy chips found in hardware wallets

Ledger hardware wallet users are reporting the sudden disappearance of digital assets from their accounts, with embedded spyware hardware suspected of stealing user data. Suspicion is focused on official reseller CryptoBillis, which Ledger has asked to suspend sales pending an official investigation.

Affected customers state that the mass cryptocurrency drain occurred specifically from devices bought through the reseller. Ledger representatives said they are actively investigating the scope and origin of the breach.

How the hidden chip works

Users on X and Threads have posted photos and videos exposing the internal layout of the tampered devices. The footage clearly shows a tiny additional microchip fitted beneath the display screen.

This hidden implant captures all information shown on the screen. The most critical moment occurs during initial setup, when the recovery seed passphrase is displayed. The chip records this phrase and transmits data directly to attackers using an integrated SIM card. Armed with the seed passphrase, hackers can remotely drain the user's crypto assets without hindrance.

Supply chain threats

Hardware wallets are widely regarded as the most secure way to protect crypto assets, but this incident highlights that physical supply chain security is just as crucial. If a device is physically modified before reaching the consumer, software protections are rendered useless.

Experts advise crypto investors, including those in Georgia, to buy hardware wallets exclusively from the manufacturer's official website and avoid third-party resellers or suspicious platforms.