Ledger: spy chip in CryptoBilis devices transmitted wallet keys

Ledger has given its first public account of the CryptoBilis breach, saying a covert "spy" chip inside devices sold by the Southeast Asian reseller could steal users' master keys by transmitting them over the mobile network without changing Ledger's software. Ledger maintains every confirmed case traces to that authorized sales channel — a framing critics reject, arguing the compromised supply chain is ultimately a Ledger problem.

Analytics firms estimate up to $93–94.5 million was drained from wallets tied to affected devices: Bitquery traced $93.2 million across 315 wallets and six blockchains, while YFarmX counted $94.5 million from 521 addresses. Tether froze $10 million in USDT tied to the theft, with roughly $81 million still traceable onchain as of Oct. 11, some of it moved through Tornado Cash and Zcash.

• Ledger advised CryptoBilis customers not to set up unused devices and to move assets to a new device with a freshly generated recovery phrase.
• Ledger has not confirmed the total stolen or whether it will reimburse victims.