Ledger spyware cases now reported in Europe and South America

Instances of physical spyware tampering on Ledger hardware wallets have reportedly been discovered in Asia, Europe and South America.

Last week, over $86 million was drained from Ledger users who had purchased wallets from CryptoBilis, a Malaysian reseller.

Mark Karpelès, the former Mt. Gox chief executive, found that spyware placed inside certain Ledger units was able to screen-scrape and capture seed phrases without triggering Ledger's Genuine Check.

Ledger stated on October 12 that the October 9 incident impacted a "limited" number of units sold via CryptoBilis.

"We are reminding our authorized resellers and distributors to source products only through authorized channels and never to restock returned products," the company said.

More Ledger wallets flagged with spyware

A user who describes himself as a semi-professional airdrop farmer, "@0xJohannes_," stated that he opened a Ledger device purchased from MediaMarkt, Ledger's authorised German reseller, and found a spy implant inside.

No funds appeared to have been taken from the device, according to the X user, who said: "Either the device didn't work or they were waiting for a more widespread usage of the comprised devices."

The same user added that "there are reported cases in Asia, South America, and now Europe as well."

PSA the ledger incident isn't limited to Asia

This is a device purchased in store from an official reseller in Europe (a legitimate device doesn't have any of these cables as can be seen in picture 2)

This even seems to be an old version of the 'spy implant' even though the… pic.twitter.com/bLWrN9aooK

— Johannes (4, 4) (@0xJohannes_) October 11, 2026

Another X account, "@Us_Chan007," posted images showing the inside of a Ledger wallet bought from LazMall, an official Philippine reseller.

Karpelès observed that this wallet contained an older spyware variant using a "manual coil antenna."

He also assisted in identifying spyware inside a Ledger Stax model that was shown by X user @wentrre, who had also purchased from CryptoBilis.

Very much a problem! Move your assets as soon as possible from any seed that touched this device

— Mark Karpelès (@MagicalTux) October 11, 2026

Nevertheless, many users have taken apart their Ledger wallets as a precaution, only to have Karpelès confirm that they are "clean."

Former CryptoBilis exec says firm is under new management

Over the weekend, focus shifted to former CryptoBilis CEO Arravind Prabu, who stated in an X conversation that the company was bought earlier in 2026 and that he has left all operational roles.

When asked about a CryptoBilis social-media post featuring a Lamborghini and pizza, Prabu said the account is now run by the new owners and that former employees were bound by a confidentiality agreement not to disclose the change in control.