Ledger: spy chip in CryptoBilis devices transmitted wallet keys

Ledger has given its first public account of the CryptoBilis breach, saying a covert "spy" chip inside devices sold by Southeast Asian reseller CryptoBilis could steal users' master keys by transmitting them over the mobile network without changing Ledger's software. Ledger maintains every confirmed case traces to that authorized sales channel — a framing critics reject, arguing the compromised supply chain is ultimately a Ledger problem.

Analytics firms estimate up to $93–94.5 million was drained from wallets tied to affected devices: Bitquery traced $93.2 million across 315 wallets and six blockchains, while YFarmX counted $94.5 million from 521 addresses. Tether froze $10 million in USDT tied to the theft. Chainalysis now reports that one of the largest victims was a fraudster behind fake online job schemes, who lost almost $5 million in bitcoin from a compromised wallet.

• Ledger advised CryptoBilis customers not to set up unused devices and to move assets to a new device with a freshly generated recovery phrase.
• Ledger has not confirmed the total stolen or whether it will reimburse victims.