# Ledger Spyware Scare Spreads Across Asia and Europe

*Author: David Christopher*
*Published: Oct 13, 2026*
*Source: https://www.bankless.com/read/news/ledger-spyware-scare-spreads-across-asia-and-europe*

---

Ledger hardware wallets sold through authorized resellers are turning up with hidden spyware capable of stealing users' recovery phrases, with suspected losses already exceeding $86 million. 

## What's the Scoop?

- **Initial thefts:** On October 9, thefts surfaced involving Ledgers sold by [CryptoBilis](https://x.com/Ledger/status/2109331538072494364), an authorized reseller in Malaysia, Indonesia, and the Philippines, prompting a Ledger investigation. Ledger has confirmed at least one hardware implant. Investigator Specter estimates over $86M stolen, while security outlet Yfarmx puts losses at $103M, per [Cointelegraph](https://cointelegraph.com/news/ledger-cellular-implants-wallets-sold-cryptobilis). Ledger hasn't verified either figure. CryptoBilis has halted hardware wallet sales, while Trezor and OneKey have cut ties. 

- **How the implants work:** The implants [read the 24-word recovery phrase](https://x.com/Ledger/status/2109896739985453358) off the screen during setup, then transmit it through a hidden cellular connection. They leave Ledger's security chip untouched, allowing devices to appear genuine. Researchers have identified [three generations](https://www.tibane.net/research/ledger-nano-x-implant) dating back to 2025, each harder to detect. 

- **More discoveries across Asia:** Former Mt. Gox CEO Mark Karpelès [confirmed an implant](https://x.com/MagicalTux/status/2109916873689280900) in a Ledger Flex bought at Singapore's airport, plus an older version in photos from another user. Tibane Labs also examined compromised Nano X devices purchased through Yahoo Auctions Japan and Amazon Japan, the latter from a China-based seller shipping from Malaysia. Neither purchase has been linked to CryptoBilis. 

- **Europe joins the investigation:** A German user [found implants](https://x.com/0xJohannes_/status/2109634513957527974) in two Ledgers bought from separate MediaMarkt stores, though Ledger says no funds were lost. MediaMarkt's parent has since [halted Ledger sales internationally](https://cointelegraph.com/news/mediamarkt-pulls-ledger-wallet-security-incident). Ledger is investigating reports beyond CryptoBilis but hasn't confirmed thefts elsewhere, maintaining that its own systems and direct sales are unaffected.
---

*This article is brought to you by [NEAR](https://www.bankless.com/sponsor/near-1785257427?ref=read/news/ledger-spyware-scare-spreads-across-asia-and-europe)*