The Ledger 'spy chip' attack is a lesson about where you buy, not what you buy

The appeal of a hardware wallet is that it takes your keys off the internet. This month’s news is a reminder that it doesn’t take them out of the physical world — and that the physical world has a supply chain.

Forbes’s October 23 summary of what it calls Ledger’s “spy-chip attack” lays out the facts as they stand. Devices bought from CryptoBilis, an authorised reseller serving Malaysia, Indonesia and the Philippines, began draining in early October. Per Ledger’s security team, a hidden implant read the recovery phrase off the screen during setup and sent it out over a mobile network through an embedded eSIM. Because the implant didn’t touch the device’s secure chip, tampered units still passed Ledger’s Genuine Check. On-chain researchers estimate losses of up to around $93 million across roughly 300 wallets; a Galaxy Research count cited by Forbes puts it near $91 million across 474 addresses. Ledger has not verified either figure.

Bloomberg reported on October 13 that Ledger blames a criminal group that bought genuine devices, implanted them and returned them to distribution, says its own systems were not compromised, has asked resellers in Southeast Asia and Hong Kong to suspend sales, and is reviewing how devices are sold. Chief technology officer Charles Guillemet said the company is also assessing its anti-tampering protections. Two days later, Bloomberg reported Ledger’s answer: a $899 smartphone-like device called Atom, available next summer.

The device did its job. The channel didn’t.

It is worth being precise about what failed. The wallet’s cryptography held. The secure element wasn’t breached. What failed was the assumption that a sealed box from an authorised seller is the same as a sealed box from the factory. A criminal with access to the reseller channel turned the single most important moment in a wallet’s life — setup, when the recovery phrase is displayed — into a broadcast.

That’s why we’d resist the conclusion that hardware wallets are now unsafe. The more useful conclusion is narrower: the purchase path is part of the security model, and most buyers have never thought of it that way.

The pattern behind the headline

This isn’t an isolated event. Forbes’s October 21 piece on more than $500 million in bitcoin hacks this year describes a summer in which a shipping-partner breach exposed the personal data of tens of thousands of Trezor customers, and a firmware bug let attackers drain roughly $130 million from another maker’s devices. The industry’s response — OneKey cutting ties with the reseller, Trezor cancelling its reseller network, Ledger building tamper sensors into a new device — tells you the makers have reached the same conclusion about the channel.

On the $899 answer

A new device with physical tamper protection is a reasonable response. It is also, as Bloomberg’s headline implies, an awkward moment to announce one, and a product that doesn’t ship until next summer doesn’t help anyone holding a wallet today. Whether a full Android device next to the signing chip is a smaller attack surface than a simple signer is a question security researchers are already arguing about. We’d wait for that argument to play out before paying for it.

What to do now

Nothing in this piece is advice about whether to hold crypto; that’s your decision and the assets are volatile. But if you already hold it on a hardware wallet, the practical steps below cost nothing: buy direct, treat the genuine check as a floor, keep the seed phrase off every screen, and test small. The device can be excellent and still arrive through a bad door. Close the door.