Ledger spyware allegedly appears in devices beyond Southeast Asia

Additional Ledger wallets allegedly tampered with and fitted with physical spyware have been identified across Asia, Europe and South America. Ledger users who bought hardware wallets from Malaysia-based reseller CryptoBilis were drained of over $86 million last week. Former Mt. Gox CEO Mark Karpelès discovered that spyware implanted in some Ledger devices was being used to read screen output. The spyware could record any seed phrase while remaining undetected by Ledger's Genuine Check security protocol.

Ledger confirmed yesterday that the October 9 incident affected a "limited" number of devices sold by CryptoBilis. Ledger said Ledger was reminding authorized resellers and distributors to source products only through authorized channels and never restock returned products.

A self-described semi-professional airdrop farmer claimed to have unpacked a Ledger device with a spy implant bought directly from Ledger's official reseller MediaMarkt in Germany. The device did not appear to redirect any funds to an exploiter. The buyer suggested that the device either did not work or that the perpetrators were waiting for wider use of compromised devices. The buyer also claimed that cases had been reported in Asia, South America and Europe.

Another user shared pictures of the interior of a Ledger wallet bought from official Philippine reseller LazMall. Karpelès noted that this wallet contained an earlier style of spyware with a "manual coil antenna." Karpelès also helped identify spyware implanted in a Ledger Stax device that another user had bought from CryptoBilis. However, dozens of users have dismantled Ledger devices out of caution only for Karpelès to tell those users that the devices were "clean."

Former CryptoBilis CEO Arravind Prabu said in an exchange on X this weekend that CryptoBilis was acquired earlier this year. Prabu said Prabu had stepped down from all operations. Asked about a recent Lamborghini and pizza post from CryptoBilis, Prabu claimed that the account was under new management. Prabu claimed that former staff signed a confidentiality clause preventing those staff from revealing that CryptoBilis had new owners.