Ledger's Spy Chip Is a Wallet Onboarding Problem
Ledger spent a decade telling people the secure element is the product. This month a small board hidden under the screen of a Nano X made that claim look narrower than it sounded. On October 9 Ledger said it was investigating stolen funds from users in Southeast Asia who bought through CryptoBilis, an authorised reseller covering Malaysia, Indonesia and the Philippines. On October 10 it confirmed that one affected device "contained an unauthorized hardware implant." By October 11 every confirmed case traced back to that one reseller, and Ledger said its own systems and direct sales were untouched. Outside researchers put the losses between $86 million and $93 million across more than 300 wallets. Ledger has not confirmed a figure.
We design wallet onboarding for a living, and what bothers us is that every screen in the setup flow told the victims they were fine.
What the implant actually does
The attack is almost boring once you see it. A hardware wallet has to show you the 24 recovery words exactly once, during setup, and to do that it sends them over a plain SPI bus to the OLED. The implant sits on those wires. Tibane Labs, which examined two units bought in Japan, describes a second tiny computer that watches the pixels go past, matches the letters against stored glyphs, saves the words, and sends them out through a cellular modem with its own eSIM and antenna. The secure element is never touched. The device works normally.
What has changed is the craft. Joe Grand's teardown of the first known unit, flagged on Reddit in August 2025, found a tangle of hand-soldered copper wire and a shrunken battery. The newest specimen, bought on Amazon Japan from a China-based seller that ships from Malaysia, has a flex board painted to match the Ledger PCB, chip markings scraped off, the original battery left alone, and a custom antenna silkscreened with its own part number, already at revision 1.1. The board is cut to key around Ledger's own components and drops into place without measuring. Somebody is manufacturing these. Mark Karpelès, who posted the first photos on October 9, called it "quite an evolution." BleepingComputer reports tampered units selling for nearly half the price of genuine hardware.
Every trust signal still said yes
Ledger's Genuine Check runs at first setup and every time the device connects to Ledger's app. It asks the secure element to prove a factory-issued key. Ledger's own support page, last updated in May, says plainly that this check cannot detect physical modifications such as embedded spy devices when the original secure element is intact. The implanted devices passed. TechTimes notes the shrink wrap on the box stays intact too. The 24 words appeared on a real Ledger screen.
So the product's whole trust vocabulary (the "genuine" badge, the instruction to verify everything on the device screen) was accurate and useless at the same time. The check verified exactly what it said it verified. The user heard something much bigger. That gap between what a badge proves and what a person thinks it proves is a copy and interaction problem before it is a hardware problem, and that makes it ours.
Onboarding is the only place left to fight
No screen layout defeats a tap on the display bus. If the words are drawn, the implant reads them. Tibane says it directly: a device that is never set up has nothing to leak. Buyers who have not set up a CryptoBilis device should leave it in the box, and buyers who have should move funds to a new seed on a device bought from Ledger. Restoring the old phrase onto a new device fixes nothing, because the phrase is what leaked.
That turns the minutes before the seed ceremony into the whole defence. Right now that stretch of the flow is a welcome screen, a PIN, and the card that tells you to write the words down. Nothing in it asks the one question that would have saved these users: where did this device come from?
What we would change in the flow
Start with the badge. "Your device is genuine" should become "Secure chip verified," followed by one line about what that does and does not cover. Ledger's support article already has the honest sentence. It belongs on the screen the user reads instead of three clicks into a help centre.
Then add a provenance step before the seed is ever drawn. Ask where the device came from and check the seller's name against the authorised list. A unit that cost half the retail price from a marketplace seller should trigger a hard stop with the inspection guide. Ledger's support page already publishes component photos of each model. Put that guide inside the app at the point where it matters, with the known tells: a thin antenna wire along the top edge, a battery that looks too small, missing foam behind the screen.
A warning you can dismiss with "continue anyway" is not a stop. The flow should require the user to confirm the source before it generates a seed, and it should give them a clean way out. When Ledger needs to reach buyers from one reseller, as it does now, the message belongs in a blocking interstitial for that serial range and region. Ledger says it is contacting affected users directly, but its public guidance so far has lived in posts on X.
Most of the wallet and dApp onboarding work we do looks like this, and the hard part is never the screens. It is convincing a product team to put friction in front of the first-run moment their activation chart loves.
The reseller is part of the product
Ledger's response has mostly been about distribution. It told distributors to source only through authorised channels, banned restocking returned units, and said it is reviewing reseller controls. None of that reaches the person who buys from a reseller on Yahoo Auctions, which is where Tibane got one of its specimens. Tibane's best guess is that a tenbaiya, a trader who relists cheap wallets bought abroad, moved it along without knowing what was inside. CryptoBilis itself was an authorised reseller. Its former co-founders say the company changed hands earlier this year and they have had no access since. The authorised badge on a shop is as narrow a promise as the genuine badge on a chip.
CoinDesk notes this follows a July 2026 Coldcard seed-generation flaw that on-chain researchers tied to $100 million to $130 million in losses. Two hardware wallet incidents in three months should retire the idea that the chip is the product. The product is the chip, the box, the seller, and the first ten minutes of the app, and the app is the only one of those a design team controls.
If your wallet shows a trust badge, write down exactly what it proves and put that sentence on the screen. The people who lost money this month were not careless. They did what the product told them to do.
Sources
- Tibane Labs, "Ledger Nano X: the spy implant", October 2026tibane.net
- CoinDesk, "Ledger says unauthorized implant found in at least one device sold by CryptoBilis", October 12, 2026coindesk.com
- BleepingComputer, "Ledger confirms spy chip implant behind wallet crypto thefts", October 12, 2026bleepingcomputer.com
- TechTimes, "Ledger Hardware Wallet Supply Chain Attack: Genuine Check Passes on Implanted Devices", October 13, 2026techtimes.com
- crypto.news, "Ledger confirms hidden chip in crypto wallet amid $92M theft claims", October 13, 2026crypto.news
- Ledger Support, "Check hardware integrity", May 13, 2026support.ledger.com
ClefDev Studio
We are a design studio working with iGaming, Web3 and fintech brands. Notes from the studio are written by the people working on the projects, not by a content team.
