How Hardware Wallets Got Drained in 2026: The Ledger Spy Chip, the Coldcard Bug, and How to Check Yours

Hardware wallets are supposed to be the safe place for crypto. This year, two separate attacks took well over $150 million from people who did what they were told. Here's how each one worked and what to do about your own device.

By the Sphinx Agent Editorial Team · Published October 31, 2026 · Facts checked against sources up to October 31, 2026.

Why this matters right now

After the $6.3 billion Binance hack, the most common advice was simple: get your coins off the exchange and into a hardware wallet. We said it too. It's still good advice for long-term savings.

But it comes with a catch that 2026 has made painfully clear. A hardware wallet is only as safe as two things you never see: where the device came from, and the code that made your seed. Both of this year's big attacks broke one of those. Neither broke the wallet's main security chip.

Attack 1: The Ledger spy chip

What happened

On October 9, Ledger opened an investigation after users reported their wallets being emptied, and asked a reseller called CryptoBilis to stop selling and shipping Ledger devices. The next day Ledger confirmed that at least one affected device contained an "unauthorized hardware implant." By October 11 it said every report of unexpected drains it had received traced back to devices sold through CryptoBilis, and described the affected volume as "limited."¹

CryptoBilis is a hardware wallet retailer based in Malaysia.¹ It had been listed as an authorized Ledger seller in Indonesia, Malaysia and the Philippines. Its former co-founders say they handed the business to new owners in March 2026.⁴

How the implant worked

Imagine someone sneaks a tiny phone inside your wallet's case. That's roughly what this was.

Ledger's own security team, Donjon, says the implant captured the 24-word recovery phrase while the owner was setting up the device, then sent it out over LTE using a built-in eSIM.² Independent researchers who opened affected units found it watched the screen output and button presses to read the phrase as it was shown.¹

Researchers found two versions:¹

• The cruder one swapped the original battery for a smaller one to make room for a small circuit board, an eSIM and a shielded LTE module. The markings on the chips had been scraped off.
• The more advanced one used the original battery and hid a professionally made flexible circuit board in the foam padding under the screen.

In both, the giveaway was the antenna wire. Researchers also said tampered units were being sold at nearly half the normal price, starting around September 16.¹

Here's the part that matters most. The implant didn't touch Ledger's Secure Element, operating system, transactions or signatures.² It didn't need to. Once someone has your 24 words, they can rebuild your wallet anywhere.

Ledger's own check couldn't catch it

Ledger's "Genuine Check" confirms that the device's Secure Element is real. According to Ledger's own support documentation, it cannot detect added hardware if the original Secure Element is intact.¹ So a tampered device could pass the check and still steal your phrase.

How much was taken

Ledger has not confirmed any total. In its words: "Figures circulating online come from third parties and Ledger has not fully verified them."²

Bitquery says wallets across six chains were emptied within 47 minutes starting October 9, including 111 Bitcoin addresses drained in a single block, after two weeks of small test transactions.⁴ That's a coordinated operation, not a lone thief. Tether froze 37 linked addresses, and about 2,990 ETH was pushed through the Tornado Cash mixer.⁴

The fallout

• MediaMarkt Saturn, one of Europe's biggest electronics chains, stopped selling Ledger devices in stores and online from October 13 after a German customer reported an implant. No money was lost in that case, and Ledger has not linked it to CryptoBilis.²
• Trezor dropped CryptoBilis as a reseller as a precaution and is shrinking its reseller network.²
• OneKey revoked CryptoBilis too, and is offering free replacements for any device bought through it between March 1 and October 13.²

Nobody has publicly named who built or planted the implants. Ledger says it's working with authorities to find them.⁴

Attack 2: The Coldcard randomness bug

What happened

This one is completely different. Nothing was added to any device, and no one had to get their hands on one.

Every wallet starts with a seed, a huge random number that your 24 words represent. If that number isn't truly random, someone can guess it. Coinkite, the Canadian company behind Coldcard, says "a firmware bug in affected releases caused weakened seed generation." Attackers then regenerated private keys offline. The devices themselves were not hacked.⁵

According to BleepingComputer's reporting, the firmware fell back on a predictable software number generator instead of the chip's hardware random source when making seeds.⁶ Coinkite estimates newer models' affected seeds had "about 72 bits of entropy rather than the expected 128 bits."⁵ TRM Labs says older devices may have had as little as 40 bits.⁸

To put that in plain terms: 128 bits is so many combinations that no computer on Earth can try them all. Every bit you lose cuts the work in half. Dropping to 40 or even 72 bits turns "impossible" into "a matter of time and money."

Which devices are affected

The risk is about which firmware your seed was created on, not which firmware you run today. Updating doesn't fix an old seed.

Standard and Edge are separate release tracks, so an older Edge 6.x isn't safe just because its number looks higher.⁵ TAPSIGNER, OPENDIME and SATSCARD are not affected.⁵

If you added dice rolls: seeds that mixed in at least 50 fair, private dice rolls are "not considered at risk from this RNG issue alone." Coinkite still recommends moving to a fresh seed.⁵

How much was taken, and why the numbers keep changing

You'll see figures from $88 million to over $150 million. They're all real counts, just taken on different days as new waves of theft showed up.

As of mid-August, Galaxy said 1,531 BTC was still sitting untouched in attacker-controlled addresses, and no confirmed attacker activity had been seen after August 6.⁹ Coinkite destroyed its remaining inventory built with the vulnerable firmware and halted shipments once the flaw was confirmed.⁷

No one has been publicly blamed. TRM Labs notes the laundering was slow, which doesn't match how North Korea's TraderTraitor usually moves money.⁸

What these attacks have in common with Binance and PHP2Shell

On the surface, a spy chip, a firmware bug, a hacked exchange and a PHP flaw have nothing in common. Look closer and the same pattern shows up in all four.

• The strong part held. Something trusted around it didn't. Binance says its signing keys never leaked; attackers used a trusted engineer's laptop instead. Ledger's Secure Element was never broken; attackers went through a trusted reseller. Coldcard's chip worked; one setting in trusted firmware didn't use it.
• Old mistakes, found late. The Coldcard bug dates to a March 2021 release.⁵ PHP2Shell sat in PHP for more than a decade. Both were in code that many people had looked at.
• Speed. Ledger victims were emptied across six chains in 47 minutes. Binance lost most of $6.3 billion in about 20.

Nobody has said AI was used in either wallet attack, and we won't claim it was. But AI is making it much cheaper to read old code looking for exactly these kinds of mistakes, as the PHP2Shell story shows. Defenders are using it. So is everyone else.

How to check your own wallet

If you own a Ledger

1. Find your receipt. Where did you buy it? If it was from CryptoBilis, or a marketplace seller shipping from Malaysia, treat it as compromised.
2. Not set up yet? Don't set it up.¹
3. Already using it? Buy a new device directly from Ledger, create a brand-new recovery phrase on it, and move everything over. Don't reuse the old phrase.¹
4. Already lost funds? Ledger says to contact law enforcement before opening the device, so evidence isn't lost.² Report it at ic3.gov if you're in the U.S., with wallet addresses and transaction IDs.¹¹
5. Buying in future? Buy from Ledger directly or a listed reseller. On Amazon, check the "Sold by" name matches the official store.¹⁰

If you own a Coldcard

1. Work out which firmware your seed was created on and compare it with the table above.
2. Update the firmware first. Then create the new seed. Doing it the other way around just makes another weak seed.⁵
3. Write down and check the new backup, and confirm a receive address.⁵
4. Send a small test amount, then move the rest.⁵
5. Keep the old backup until you're sure the move worked. Then never use it again.⁵

Good habits for any hardware wallet

• Check the packaging. Coldcard bags carry a number printed in three places that must match what the device shows when first powered on.¹² If anything looks opened or resealed, stop.
• Add your own randomness. If your wallet supports dice rolls, use them. Coinkite says 50 to 98 private rolls give at least 128 bits.⁵
• Consider a strong passphrase (sometimes called the 25th word). It's an extra lock that the 24 words alone can't open. Make it long and unique, and back it up separately.⁵
• Keep your backup offline and private. Paper or metal, stored somewhere safe. Don't tell people how much you hold. CertiK counted 52 verified physical "wrench attacks" on crypto holders in the first half of 2026, up from 39 a year earlier.¹³
• Plan for no internet. If a storm or outage knocks out power for days, you still want to know where your backup is and how to reach your funds. Our emergency preparedness fact check covers what governments actually recommend.

Frequently asked questions

Was Ledger hacked?

Ledger says its own systems weren't compromised. Some devices sold through reseller CryptoBilis had an added spy chip that stole the recovery phrase at setup.^1,2

How much did Ledger users lose?

Ledger hasn't confirmed a figure. Analysts estimate $86 million to $103 million.^3,4

What was the Coldcard hack?

A firmware bug made some seeds weak enough for attackers to rebuild offline. Galaxy confirmed at least 1,778 BTC, about $112 million, taken.^5,9

Does Ledger Genuine Check detect the implant?

No. It verifies the Secure Element only.¹

Are hardware wallets still worth it?

Yes, for long-term holdings, if you buy direct, check the packaging and set it up yourself. Both attacks went around the wallet's core security, not through it.

Is this connected to the Binance hack?

No link has been reported. The Binance hack was blamed on North Korea's TraderTraitor, and neither wallet attack has been attributed to anyone.⁸