Ledger with a spy chip found on Ozon: what we know and what to do if your wallet came from a marketplace

What was found inside the Ledger from Ozon

The story of Ledger hardware wallets with a spy implant has reached Russia. The open registry of infected devices that Mark Karpeles has been keeping since October 13 now has an entry for a Ledger Nano X bought on Russia's Ozon marketplace. Bits.media reported it on October 16.

The buyer opened the device and posted photos. Inside was something a genuine Nano X does not have:

• a thin black board between the screen and the main board, carrying a cellular module and an antenna connector;
• a printed antenna in the case with a Chinese marking that means "Eurasian version" and the revision number V1.1;
• a replaced battery with a small board and wires soldered to the wallet's board next to the USB-C port.

The same battery was found in the first infected device from MediaMarkt, and the antenna is a later revision of the same part. We found no response from Ozon or Ledger to this particular case.

Ledger does not sell officially in Russia: the list of authorized resellers on its website includes neither Russia nor Ozon. Everything sold on marketplaces comes through middlemen, and each of them is one more link between the factory and your coins. The same goes for crypto itself: the fewer hands between you and your coins, the better, which is why many people skip custodial trading platforms and buy through a crypto exchange that pays out straight to their own address.

How the implant works

Ledger described the mechanism on October 13 after a teardown by its Donjon security team. The implant does not break the secure chip and does not change the firmware. It reads what the screen shows.

"During setup, the signer displays the 24-word recovery phrase. When the implant detects these screens, its microcontroller decodes the words and transmits them over LTE using a provisioned eSIM."

Hence the main takeaway: the dangerous moment is wallet creation. The phrase goes to the attacker, the wallet looks and works as usual, and later it gets drained. That is what happened on October 9 to buyers from the Malaysian reseller CryptoBilis: Bitquery analysts estimate that about $102 million was taken from 324 wallets in a single day. Ledger does not confirm the total. We covered it in detail in our article on the confirmed implant in Ledger devices.

An important detail: Ledger's built-in authenticity check, Genuine Check, does not catch this implant. Ledger itself says the check "cannot detect unauthorized physical modifications to the hardware" if the original Secure Element remains intact. The buyer of the first device from MediaMarkt says his wallet passed the check.

15 devices, 9 sellers

As of October 16, Karpeles's registry lists 15 entries from 9 sellers. In 12 cases the implant is confirmed, two more are counterfeits, and one device is on its way for a teardown.

Implants have turned up in the Nano X, Flex and Stax. The first cases go back to 2025, and the first public teardown of the implant came from researcher Joe Grand in July 2026. On October 15 Ledger wrote that "This was not a systemic supply chain attack, it was a localized distribution attack." It asked for sales in Southeast Asia and Hong Kong to be suspended and told resellers that stock "should stay in the back and be handed over at the time of purchase" instead of going on shelves or displays.

We have already covered how, after this story, Trezor cuts resellers and MediaMarkt pulls Ledger from its stores.

Phishing disguised as a "firmware update"

Meanwhile, scammers started cashing in on the fear. On October 16 SlowMist warned about an email campaign in Ledger's name: the message says a firmware update is needed to protect the device against "emerging spyware threats, such as recent incidents in Malaysia", and leads to a site with a device picker and a fake Genuine Check page.

It looks convincing, but the goal is the same: the recovery phrase. SlowMist advises never clicking website links to update firmware and never entering your recovery phrase anywhere. Ledger, for its part, reminds users that it "will never call you, message you directly, or ask for your 24-word recovery phrase." Firmware is updated only in the official Ledger Wallet app.

The scammer who got robbed

The story also has an almost comic side. According to Chainalysis, one of the biggest victims of October 9 was a scammer: he lost more than 60 BTC, about $4.8 million.

The money came from a "task" scam: people were paid to fake sales and reviews, then shown a "negative balance" and told to add their own money. On September 22 the organizer moved the proceeds to three Ledger addresses, and on October 9 the thieves emptied all three, with one transfer each into the same wallet.

What to do if your Ledger was bought on a marketplace

If your wallet was not bought from Ledger or an authorized reseller, assume the phrase may have leaked. This is what Ledger advises CryptoBilis buyers, and the same steps make sense for any device from an unofficial channel:

1. Do not create a wallet on it or enter your phrase into it if you have not set it up yet.
2. If you already use it, buy a new device from the manufacturer, create a new wallet on it with a new phrase and move all your coins there. Speed matters more than fees.
3. Do not open the device until you have moved your funds: it is easy to damage it while opening.
4. Do not update firmware from links in emails and messages, only in the Ledger Wallet app.
5. Check the packaging and the recovery sheet: a new wallet never arrives with a pre-filled phrase or PIN code.

The main rule has not changed: whoever knows your phrase owns your coins. We covered how to keep it safe and what to do after a leak in our guide on how to store a seed phrase.

How to move coins to a new wallet without extra middlemen

If you are moving to a new wallet, it is convenient to receive coins on it directly, without leaving them on an exchange account along the way.

VertEXchange has no accounts: no email, phone number or password needed. You pick a pair, enter the address of your new wallet and see the rate and the amount you will receive before you send anything. Coins go straight to your address, and the service does not hold them.

• The fixed rate holds for about 15 minutes while the transfer confirms.
• You can set a refund address in case the exchange does not go through.
• Personal fields of the transaction are deleted 24 hours after it completes.
• Support chat is available on every page, and issues are resolved by exchange ID.

This way you can buy bitcoin with USDT TRC20 straight to the address of your new hardware wallet or exchange ETH to BTC without a trading platform.

FAQ

Does Ledger sell wallets officially in Russia?

No. Ledger's list of authorized resellers includes neither Russia nor Ozon, so every device on Russian marketplaces comes through middlemen.

Can Genuine Check detect an implant in a Ledger?

No. Ledger itself says Genuine Check cannot detect unauthorized physical modifications to the hardware if the original Secure Element remains intact. The implant is only visible once the device is opened, and it is best to open it only after moving your funds.

Which Ledger models have been found with an implant?

According to Karpeles's open registry as of October 16, 2026: Nano X, Flex and Stax. The Nano S Plus appears in the registry only as a counterfeit.

What should I do if my Ledger was bought on Ozon or another marketplace?

Buy a new device from the manufacturer or an authorized reseller, create a new wallet on it with a new phrase and move all your coins there. Do not use the old phrase again.

Can I update Ledger firmware from a link in an email?

No. Firmware is updated only in the official Ledger Wallet app. Ledger never calls you, never messages you directly and never asks for your 24-word recovery phrase.

How much was stolen through infected Ledger devices?

Bitquery estimates about $102 million from 324 wallets on October 9, 2026, almost all of it from CryptoBilis buyers. Ledger does not confirm the total.