Ledger Hidden Chip Attack: 4 Checks for Your Hardware Wallet

Hardware wallets are supposed to be the safe option. But in October, a wave of Ledger owners in Southeast Asia found their wallets emptied, and Ledger later confirmed that at least one affected device had a hidden chip inside it that should not have been there.

The attack did not break Ledger’s systems, according to the company. It targeted something most holders never think about: where their device came from before it reached them. A Bullrunners video walks through what happened, why the usual safety advice falls short here, and four checks any self-custody holder can run on their own setup.

What happened to the Ledger wallets?

On Friday morning, October 9, people began posting on X and Reddit that their Ledger hardware wallets had been drained. These were not exchange accounts but devices held by the owners themselves.

By early afternoon, an on-chain investigator had traced the stolen funds to a handful of collection addresses on the Bitcoin, Ethereum and Tron networks. His count, per the video, was at least $86 million:

Asset	Approximate amount stolen
Ethereum	$42 million
Bitcoin	$17.5 million
USDT	$16.5 million

Two other on-chain analysts have since put the total closer to $93 million. Ledger has not confirmed any figure, so the video sticks with “at least $86 million.”

What did Ledger say?

Ledger said it was investigating losses among users in Southeast Asia who bought from a single reseller, one that was listed as an official Ledger reseller in Indonesia, Malaysia and the Philippines.

The company told anyone who bought from that reseller in the last 90 days not to set the device up. Anyone who already had was told to move their crypto to a new device with a brand new seed phrase. On Saturday, Ledger confirmed that one affected user’s device contained an unauthorized hardware implant.

Ledger also said it has no sign its own systems were compromised. As the video puts it, this is not a case of “Ledger got hacked.” It is a supply chain problem, which is arguably more uncomfortable, because the device itself looked legitimate.

How did the hidden chip steal seed phrases?

The implant is believed to have read the recovery phrase off the screen during setup and sent it to the attacker. Mark Karpelès, the former head of Mt. Gox, has been taking apart tampered Ledger devices. According to the video, he documented an extra circuit board hidden inside a Nano X with its own mobile connection.

Based on those findings, the implant does not attack the secure chip at all. It watches what is sent to the screen. When a new Ledger displays your 24 words for the first time, the implant reads them and transmits them.

That matters because the seed phrase is not a password for the device. It is the wallet. Anyone with those 24 words can rebuild the wallet on any device, anywhere. This explains how someone could store their seed in a safe, barely touch the device, and still lose everything. If the words were copied during setup, they were gone before they were ever written down.

The video is careful to note the limits of what is known. Ledger has confirmed only one implant so far. Investigators have not proved every drained wallet had one, and some cases may turn out to be phishing scams.

Why the “send a small test first” advice doesn’t help here

The pattern of the thefts suggests the attacker waited for large balances rather than draining every wallet at once. One analytics account counted 98 wallets in this case, an average of close to $900,000 per wallet. The video contrasts that with a separate incident this summer that affected more than 5,000 wallets at around $21,000 each.

Fewer wallets with much larger balances fits someone who already had the seeds and chose which wallets were worth taking. That undermines the common advice to send a small test amount, wait a couple of weeks, then move the bulk of your funds. If a seed was copied on day one, the thief has no reason to touch a test transaction. They can wait for the big deposit.

The people hit hardest, the video notes, were serious holders who did the responsible thing and moved their crypto off exchanges.

Can Ledger’s genuine check catch a tampered device?

No, not this kind of tampering. Ledger’s app includes a genuine check, and the video says it is useful: it proves the secure chip inside the device is real.

But Ledger’s own guidance says the check cannot verify the device’s physical supply chain history and cannot detect every physical modification. That is exactly what this attack used: a real chip with something extra sitting next to it. The check that matters, according to the video, is not in the app. It is the paper trail showing how the device reached you.

Four checks to run on your own setup

The video lays out four checks for any hardware wallet owner.

1. Where did your device come from? Find the receipt. So far Ledger has named only one reseller, so nothing currently points to devices bought directly from Ledger’s own shop. If yours came from a reseller, a marketplace, a second-hand listing or a deal that looked too cheap, you cannot prove where it has been. That does not mean it is compromised, only that you cannot show it isn’t.
2. Who created your seed? A genuine Ledger never arrives with a PIN already set or words already written down. The recovery sheet should be blank, and the device should have offered “set up as new device” and generated the 24 words in front of you. If any words came in the box, someone else has them too.
3. Can you prove the route your device took? If not, the video’s advice is to treat the seed as seen. That means a new device bought straight from the manufacturer, a brand new seed, and moving everything across, which mirrors what Ledger told the affected reseller’s buyers.
4. How much depends on one device, one seed and one supply chain? For many holders, the answer is everything, which is a single point of failure. The video suggests separating long-term holdings from money you move around, spreading larger holdings across more than one wallet, ideally from different manufacturers and each bought direct.

For larger amounts, some people use multi-sig (multi-signature), where two or three devices must approve before anything moves, so one tampered device is not enough on its own. The video cautions that multi-sig is more complex and a mistake can lock you out, so it should be learned properly before you rely on it.

Moving XRP to a new wallet safely

If you hold XRP and decide to move to a new device, a few XRP Ledger rules apply, according to the video:

• Every new XRP Ledger address must hold 1 XRP as a reserve before it exists (about $1.40 at the time of recording), so your first transfer must be larger than that.
• Send a small test first, and confirm the receiving address on the hardware device’s own screen, not just your computer.
• You do not need a destination tag when sending to your own wallet. Tags are for exchanges.

The video also flags a fake Ledger website that a security researcher found ranking at the top of Google, asking visitors for their 24 words. Ledger will never ask for your recovery phrase through support, an app or a website. The only place those words should ever go is back into a device you control.

The 60-second device origin audit

The video closes with a five-question audit. If you cannot answer all five right away, that is the work to do this week.

1. Where did I buy this device, and do I have the receipt?
2. Was the recovery sheet blank, and did I choose “set up as new”?
3. Has my seed ever been typed, photographed or stored online?
4. What share of my crypto sits behind this one seed?
5. If this seed leaked tonight, where would I move everything, and is that wallet already set up?

What to watch next

The story is still developing. Watch for whether Ledger confirms more implants beyond the single device verified so far, whether it publishes a confirmed loss total, and whether any other resellers are named. Until then, the most useful step is the one that costs nothing: find your receipt and check how your device and seed came to be yours.