{
  "id": 14285466,
  "title": "Ledger Confirms Spy Chip Implant Behind Wallet Crypto Thefts",
  "url": "https://urgent.news/2026/10/13/ledger-confirms-spy-chip-implant-behind-wallet-crypto-thefts",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-13T20:00:00.000Z",
  "source": {
    "name": "Slashdot",
    "slug": "slashdot",
    "url": "https://yro.slashdot.org/story/26/10/13/192236/ledger-confirms-spy-chip-implant-behind-wallet-crypto-thefts"
  },
  "original_language": "en",
  "account": "Ledger, a well-known cryptocurrency hardware wallet manufacturer, has confirmed that certain devices purchased from an unauthorized Southeast Asian reseller have been tampered with. The compromised hardware implants within these devices have been draining users' cryptocurrency wallets. The investigation began after reports surfaced of users losing funds from wallets acquired through a prominent Malaysian hardware wallet retailer, CryptoBilis.\n\nResearchers have uncovered the existence of the implant since September 16, revealing that the tampered devices were being sold at a significantly lower price compared to the original hardware. The threat actor managed to fit the malicious circuitry by replacing the original battery with a smaller one, allowing the implant to power both the device and the Ledger X. Underneath the battery and antenna, the researchers discovered an ST STM32G431KBU6 microcontroller, complete with 128 KB of flash memory, housed within a 32-pin surface-mount device package.\n\nTo transmit the stolen data, the attacker utilized a tiny eSIM module, just 2x2 mm in size, alongside a shielded LTE module. Ledger has issued a warning to users, urging them to purchase devices exclusively from authorized resellers to avoid the risk of acquiring counterfeit or modified equipment. Additionally, the company advises its authorized resellers and distributors to source products solely through legitimate channels and to refrain from restocking returned items.\n\nLedger has incorporated a \"Genuine Check\" mechanism to help users confirm the authenticity of their devices; however, the company explicitly states that this feature cannot detect the presence of added implants if the device's original Secure Element remains intact. Users are strongly encouraged to exercise caution when purchasing cryptocurrency hardware wallets to protect their digital assets.",
  "summary": "Longtime Slashdot reader AmiMoJo shares a report from BleepingComputer: Ledger has confirmed that some of its devices distributed through Southeast Asian reseller CryptoBilis were compromised with a hardware implant that drained users' cryptocurrency wallets. The company has been investigating reports of users losing funds from wallets purchased through CryptoBilis, a major Malaysia-based…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}