Ledger Spy Implant Scare Reaches Europe as PeckShield Traces $3.89M in Theft Funds to Binance

Published October 12, 2026, 01:25 PKT. Based on Ledger's October 9-10 statements, Mark Karpelès's technical analysis of the recovered implants, PeckShield's on-chain tracing reported by The Defiant, and reporting by Stocktwits, PANews, CoinCentral and CryptoNews.net.

The Ledger hardware wallet supply-chain attack that has drained tens of millions of dollars from users in Southeast Asia has reached Europe, according to a report published October 11. A crypto user who goes by Johannes disclosed Sunday that a Ledger device bought in a store a couple of weeks ago from an official European Ledger reseller contained a spy implant, with photos showing extra wires inside that genuine Ledger hardware does not have. The find, first reported by Stocktwits, extends the scare beyond the CryptoBilis reseller in Indonesia, Malaysia and the Philippines where Ledger has confirmed tampering.

The European implant find

Johannes, a well-known crypto user who tracks bad actors on X, said the device was bought at a store a couple of weeks ago and urged anyone who did not buy directly from Ledger's online store to open their device and check it. He said the European device never sent funds to an attacker, and it is unclear whether the implant failed or the attackers are still waiting.

Mark Karpelès, chief executive of Karpelès Lab, confirmed the find on X. "Another spy implant confirmed," he wrote, adding that it looked like an earlier version of the implant he is studying, "meaning there were more iterations." PANews reported that researchers said the European implant appears to use an earlier design, while newer implant components may be hidden behind the screen, making detection harder. Ledger has not issued a public statement confirming or disputing the European allegation as of publication, and has previously said it received no comparable reports involving devices bought through its own direct sales channels.

The $3.89 million Binance trail

Separately, security firm PeckShield traced $3.89 million from the Ledger wallet drain to Binance deposits on Tron, according to a report by The Defiant published October 11. The deposits give investigators an exchange-account lead, though The Defiant noted that intermediary wallets handling money for multiple clients complicate attribution.

Binance chief executive Richard Teng said the exchange stands ready to support tracing and recovery efforts, and Binance co-founder Changpeng Zhao wrote that the incident appears to be a localized supply-chain attack with one vendor, with a small number of buyers likely having received fake or tampered Ledgers. In a separate laundering route, CryptoNews.net reported that the attacker converted millions in stolen USDT into USDD, a stablecoin whose freeze controls do not cover Tether's USDT, according to security firm Hacken. Bitquery estimates about $10 million has been frozen so far, though the firm cautions the figure is an analyst estimate, not an announced repayment to customers.

How the implant steals seed phrases

Karpelès said the implant targets device setup: it watches the screen to capture and transmit the seed phrase, the list of words that can unlock a wallet's funds. He said the implants have evolved a lot in recent months, becoming harder to spot and easier to install, and warned that an attacker could steal the assets immediately or wait months. Anyone whose seed phrase was created on an implanted device should generate a new one on a safe device and move their assets, he said.

Researchers also warned that Ledger's official Genuine Check software mainly verifies device authenticity and may not detect unauthorized physical hardware modifications when the original secure element has not been compromised, according to PANews.

Losses top $91 million, Galaxy says

Galaxy Research now estimates the theft at $91 million spanning nearly 500 addresses, according to CryptoNews.net. Tron was the hardest hit with 276 victim addresses drained of about $64.5 million, followed by Bitcoin with 276 addresses losing $17.7 million and Ethereum with $8.8 million across 55 addresses. Galaxy's head of research Alex Thorn called the $91 million figure a "floor," saying the total could rise after Ledger completes a full audit in the coming days. Bitquery's wider analysis put the tally at $93.2 million across 315 wallets spanning Tron, Bitcoin, Ethereum, Solana, BNB Chain and Polygon.

Ledger's official guidance

Ledger confirmed on October 10 that at least one affected customer's device contained an unauthorized hardware implant, the first time the company confirmed physical tampering. The company said it is contacting potentially affected customers and working with authorities, and stressed it has no indication that Ledger's security infrastructure, systems or services were compromised.

For buyers from CryptoBilis in the past 90 days who have not initialized their device, Ledger said not to start setup. Those who already set up a device should consider moving assets to a new Ledger signer with a newly generated recovery phrase, since reusing the old phrase would expose the same keys. Ledger also reminded users it will never ask for a 24-word recovery phrase.

This article is news reporting and is not investment advice.

Sources

• Ledger Support (@Ledger_Support), statements on X (October 9-10, 2026), primary source for the investigation status, the unauthorized implant confirmation, the claim that company infrastructure was not compromised, and customer guidance
• Mark Karpelès, Karpelès Lab CEO, posts on X (October 10-11, 2026), primary source for the technical analysis of the implants and the confirmation of the European find
• PeckShield, on-chain analysis reported by The Defiant (October 11, 2026), primary source for the $3.89 million trace to Binance deposits on Tron
• Galaxy Research, analysis reported by CryptoNews.net (October 11, 2026), primary source for the $91 million loss estimate across nearly 500 addresses
• Stocktwits (October 11, 2026), secondary source for Johannes's report of the spy implant in a device bought from an official European Ledger reseller
• PANews (October 11, 2026), secondary source for the earlier-iteration implant design and Genuine Check limitations
• CoinCentral (October 11, 2026), secondary source for the Ledger confirmation summary and customer guidance
• CryptoNews.net (October 11, 2026), secondary source for the USDT-to-USDD laundering route and Binance cooperation