JANUSZ KRYPTO: Is My Ledger Safe? Spyware in Wallets and Stolen Millions

The internet has been buzzing for several days. People are looking at their Ledger hardware wallets in horror, as over 90 million USD has allegedly evaporated from accounts, all due to a scandal that sounds like a movie script. It turned out that someone had sewn "spyware" into factory-sealed Ledgers at an Asian distributor. Should we be worried? I asked cybersecurity expert Łukasz Mikuła about this.

Photo: Everett Collection / / Shutterstock

At the time of writing this text on Wednesday, October 14, 2026, Ledger has still not provided the number of victims or the value of the stolen funds. Analysts tracking data on the blockchain estimate losses to be up to 93.2 million USD from over 300 wallets. The company Tether has frozen 10 million USD in the stablecoin USDT related to the theft.

The portal "CoinDesk" reported on Tuesday that the German MediaMarkt has halted the sale of Ledger hardware wallets. About that time, I received a question from a reader: "Mr. Janusz, I just bought a Ledger at an electronics supermarket, should I run away with my cash? Disassemble it?".

I called Łukasz Mikuła, a cybersecurity expert in the cryptocurrency world. And the first, most important thing I heard should somewhat calm the hot heads - the most important element of Ledger wallets, the "Secure Element," has not been compromised.

• Ledger declares no signs of breach in its infrastructure, systems, and direct sales channel - Łukasz Mikuła explained to me. - This is important because if we believe these reports, we can assume that the problem lies with resellers, not with the manufacturer itself.

Hackers did not break the cryptography. The problem lies with the sellers.

• According to Ledger's current communications, all confirmed thefts related to the incident concern devices sold by CryptoBilis, an authorized reseller operating in Asia. The company is still determining who modified the hardware and at what stage of distribution. This is somewhat reassuring for our European market, although it cannot be said that it does not concern us at all - Łukasz Mikuła cautioned.

Suspicious Ledger in a German Electronics Market?

Separately, a report from a customer in Germany is being investigated, who claims to have found unauthorized modifications in two devices purchased from one of the well-known electronics supermarket chains. As the expert points out, the matter is not confirmed, and no funds have yet been lost from the allegedly infected device. Nevertheless, Łukasz Mikuła advises not to ignore these reports.

• Why do I mention this? To keep an eye on the situation. At this moment, there is no confirmation of this attack in Europe. And where is the line of uncertainty? Here, everyone should answer for themselves what risk they are willing to tolerate. If we hold small amounts in the wallet, we can approach the incident with more calmness than if we recently bought such a wallet and transferred bitcoins accumulated over several years into it.

How Were Ledger Wallets Emptied? A "Spy" Was Enough

I asked Łukasz to explain to me "in simple terms" how the attack on the wallets occurred. Since the heart of the device was not broken, how do thieves extract money?

• The described attack does not require breaking the protections of the Secure Element, which is the protected chip storing the wallet's secrets. The attack consists of physically placing a module inside the device's casing that intercepts information displayed to the user - such a spy - says Łukasz Mikuła.

As he emphasizes, this is puzzling because someone had to breach the packaging and the structure of the wallets themselves.

• The situation appears to be quite a complex operation, and I am curious to see what the incident analysis will reveal and who will turn out to be the perpetrator," comments the expert. - Returning to the issue - this bug recognizes 24 recovery phrase words during setup and sends them via an LTE modem using a built-in eSIM chip - in other words, it simply listens to the seed phrase and sends it out into the world.

After obtaining the data needed to recover the wallet, the attacker can recreate the keys outside the victim's device.

• Since the seed phrase is the exclusive condition for controlling the wallet, once it is intercepted, that cold wallet is no longer cold - to put it bluntly, an attacker on the other side of the world can import that seed phrase and become a full co-holder of the wallet - describes Łukasz Mikuła.

Do You Have a Ledger? What to Do and What NOT to Do

First of all, put away the screwdriver. Łukasz Mikuła warns that disassembling the device will yield nothing without specialized knowledge. First, determine where the device came from.

• If by some chance we have a wallet purchased through an Asian intermediary in the last two years, we should definitely replace it - buy a new one, set up a new seed, transfer the funds, and forget about the old one - advises the expert - When purchasing from another seller, I would rather just monitor the situation, although individual risk assessment depends on each of us and primarily on the funds we have - he adds.

What is the key advice for those who suspect their device may have been tampered with?

• Treat the recovery data entered or displayed on it as potentially compromised. If you decide to change wallets, remember that restoring the old phrase on new hardware does not solve the problem, nor does changing the PIN. What cryptocurrency users should know is that the guarantee of control over the funds is that only we know our seed phrase - reminds Łukasz Mikuła.

In the end, the expert alerted me and asked me to warn you about secondary scams. In such moments, criminals may try to fish for victims with fake emails from "technical support" and similar impersonators posing as Ledger. Such situations become a breeding ground for further criminals who attempt phishing - taking advantage of the tense atmosphere, they hope that recipients will be more willing to interact with them or open potentially dangerous attachments.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.