You buy a hardware wallet so that nobody can touch your cryptocurrencies. The box arrives sealed, the device passes the official authenticity check and you write your 24 words down on paper. And even so, someone walks off with your funds. That is what has happened to hundreds of buyers of Ledger devices sold by a reseller, CryptoBilis: inside, they carried a spy chip.
The short answer: the flaw was not in Ledger, but in the route the box took to the buyer’s home. If you bought your Ledger on the official website, there is no indication that you are affected. If you bought it from a reseller, a private seller or on a marketplace, there are specific steps worth taking. At CryptoImpuestos we have followed the investigation since the first warning, and here is what is known, what is not and how to buy a wallet without this risk.
What has happened with Ledger?
Ledger is the best-known maker of physical wallets: a device the size of a USB stick that stores the key to your cryptocurrencies without relying on any exchange. What is known as a hardware wallet or cold wallet.
The facts, in order:
- 9 October 2026. Ledger announces it is investigating thefts from users after blockchain analysts estimate more than 86 million dollars stolen.
- 10 to 12 October. Ledger confirms that one victim’s device carried an unauthorised hardware implant and that all the confirmed losses relate to devices sold by CryptoBilis, a South-East Asian reseller listed on its website as a distributor. CryptoBilis stops selling Ledger.
- 13 October. Ledger publishes how the implant worked. That same day MediaMarkt Saturn stops selling Ledger devices after a customer in Germany found a tampered one.
Investigators’ loss estimates reach 93.2 million dollars across more than 300 wallets, according to CoinDesk. Ledger has not confirmed that figure and speaks of a “limited” volume. Tether froze around 10 million in USDT linked to the theft.
How did the chip steal the 24 words?
When you set up a Ledger for the first time, the device generates your recovery phrase and shows it on its screen so you can copy it: 24 words that are the backup of your key. Whoever has those words has your cryptocurrencies.
The implant was hidden inside the casing. According to Ledger’s explanation, a small microcontroller read the screen while it displayed the words, decoded them and sent them over the mobile network using an eSIM and an antenna. With that, the attacker could restore your wallet on another device and empty it whenever they wanted.
The most unsettling part: the implant did not modify the secure chip or the device’s system, and it did not alter transactions either. That is why Ledger’s official authenticity check tool, the Genuine Check, passed the device as genuine. The published analyses describe two variants: one replaced the battery with a smaller one to make room, and another was hidden behind the screen. The antenna was the clue that gave the tampering away when the device was opened.
The flaw was in the route, not in the wallet
Ledger insists that its systems have not been attacked and describes it as a physical attack on the supply chain. It is not yet known who put the chip in or at what point between the factory and the buyer. According to the published analyses, the devices were sold as new and with the box sealed.
There is one fact that complicates things: Mark Karpelès, the former head of Mt. Gox, said he found an implant in a Ledger Flex bought at a shop in Singapore airport, and Ledger says it is reviewing other reports from different places. In the meantime, it has asked shops and distributors not to resell returned devices.
How can you tell if your Ledger is affected?
There is no reliable home test: the Genuine Check does not detect it and opening the device is not something you should do. What you can do is answer two questions.
Where did you buy it?
- On Ledger’s official website: there is no indication that those devices are affected.
- From CryptoBilis: Ledger asks you not to initialise it if you have not yet done so and, if you are already using it, to move your funds to a new device.
- From another shop, a marketplace or a private seller: there is no evidence that you are affected, but you cannot rule it out entirely either. Weigh up how much you hold on it.
How did you get the 24 words?
The words are always generated by the device itself and shown on its screen. If they came printed in the box, on a card or someone gave them to you, do not use that device: it is a scam that has been known for years, chip or no chip.
If in doubt, the solution is the same one Ledger gives: buy a new device on the official website, create a new set of words on it and move your cryptocurrencies there. Moving funds from one wallet of yours to another wallet of yours is not a sale.
How to buy a secure hardware wallet
This applies to Ledger and to any other brand:
- Buy on the manufacturer’s official website. It is the shortest route between the factory and your home.
- Be wary of bargains. A price well below the official one on a marketplace is a warning sign, not an opportunity.
- Never second-hand. Even if it is “unused”.
- The device generates the words, in front of you. If they come written down, send it back.
- Write them down on paper or metal, never on your phone, in a photo or in the cloud.
- No legitimate party will ever ask you for them: not the manufacturer, not support, not us.
- Make a small test transfer first and check the address and the network.
If you are not sure what a wallet really holds and why those 24 words are worth so much, we explain it from scratch in what a crypto wallet is.
And the tax agency? Moving your crypto to a new wallet is not taxed
Two questions we are getting these days:
- Moving your cryptocurrencies to a new wallet is not a sale. There is no gain or loss as long as they are still yours. That said, keep a record that both addresses are yours: when you sell, you will have to show where they came from. We cover it in how to export your wallets’ transactions.
- Holding cryptocurrencies in self-custody does not exempt you from declaring them. The AEAT (Spanish tax agency) can follow the trail of what leaves an exchange for a wallet, as we explain in how the tax agency knows you have a cold wallet.
If you have suffered a theft, the tax treatment of that loss depends on each case and on what you can prove: a police report, on-chain movements and ownership of the addresses. Keep all the documentation from day one.
Summary: what to do depending on where you bought your Ledger
| Where you bought it | Risk based on what is known | What to do |
|---|---|---|
| Ledger’s official website | No indication of being affected | Nothing special; follow good practice |
| CryptoBilis | All the confirmed losses come from here | Do not initialise it, or move the funds to a new device with new words |
| Another shop, marketplace or private seller | No evidence, but it cannot be ruled out | Consider moving the funds to a new device bought on the official website |
| It came with the words printed | Definitely a scam | Do not use it |
Frequently asked questions
Has Ledger been hacked?
According to Ledger, no: its systems and software have not been compromised. It was physical tampering with devices at some point in the distribution chain, and the investigation is still open.
Does the Genuine Check detect the spy chip?
No. The implant did not touch the secure chip, which is what the Genuine Check verifies, so the tampered device passed the test as genuine.
I bought my Ledger on Amazon. Am I at risk?
There is no evidence that devices sold through other channels are affected, but there are other reports Ledger is reviewing. If you hold a significant amount, the most prudent option is to move the funds to a device bought on the official website, with new words.
How much money has been stolen?
Blockchain analysts estimate up to 93.2 million dollars across more than 300 wallets, according to CoinDesk. Ledger has not confirmed the figure and speaks of a limited volume.
Is moving my crypto to another wallet of mine taxed?
No. Moving cryptocurrencies between your own wallets is neither a sale nor a swap. They will be taxed when you sell them, exchange them for another crypto or pay with them.
Your crypto, safely stored and properly declared
A secure wallet protects your cryptocurrencies; an orderly history protects you with the tax agency. If you have moved funds between exchanges and wallets and do not know how to make it all add up, send us your history and we will produce the document with all your exchanges and wallets using the global FIFO method the tax agency requires.
Sources: CoinDesk: Ledger explains the spy chip in CryptoBilis devices (13/10/2026) · BleepingComputer: Ledger confirms the implant (12/10/2026) · CoinDesk: Ledger investigates thefts worth 86 million (09/10/2026) · Ledger Support on X: recommendations
Víctor Lázaro
Marketing Director, Cryptoimpuestos.es
