DoubleChecks

What was claimed

Hackers stole over $80M by inserting microscopic spy chips into Ledger Bitcoin wallets from an official authorized reseller in Malaysia listed for years, silently capturing private keys

Our verdict

Needs caution

Reporting and on‑chain analysis show funds were taken across multiple blockchains (Ethereum, TRON, USDT on Tron and others), not just Bitcoin. CryptoBilis was reportedly listed by Ledger as an authorized reseller and operated in Malaysia, Indonesia, and the Philippines. The available reports do not independently establish the exact duration of its listing as 'for years.'.

Combined assessment11 sourcesChecked Oct 12, 2026

Why this verdict

  • This affected only Bitcoin wallets

    Incorrect
    One assessment reached this conclusion

  • The spy chips silently captured private keys (allowing theft without user interaction)

    Misleading
    Two assessments reached this conclusion; one differed·ChatGPT: Can’t verify

  • The compromised devices came from an official authorized reseller in Malaysia that had been listed for years.

    Misleading
    Two assessments reached this conclusion; two differed·Claude: Verified, ChatGPT: Can’t verify

  • Hackers inserted microscopic spy chips into the Ledger wallets.

    Can’t verify
    One assessment reached this conclusion; one differed·Claude: Verified

Evidence reviewed

11 sources

Perplexity and Claude sources are combined here. No source links were stored for ChatGPT.

tokenpost.comx.comcrypto.newstechflowpost.comlearningcrypto.comprotos.comwebpronews.comchaincatcher.comshattered.iotftc.io

Individual assessments

Assessment summary

  • The core incident is supported by multiple reports, including Ledger’s investigation and alleged losses exceeding $80 million.
  • However, the claim states the spy-chip mechanism and complete private-key capture as established facts, while available evidence includes allegations and technical theories; the amount and reseller details also vary.

Claims reviewed

The implants silently captured users' private keys.

Misleading
Reports describe a suspected module that may have intercepted recovery phrases displayed during wallet setup and transmitted them over cellular hardware.techflowpost.com chaincatcher.com That is not the same as directly capturing private keys from the Ledger secure element, and the mechanism remained under investigation.

This claim may mislead readers without added context.

The compromised devices came from an official authorized reseller in Malaysia that had been listed for years.

Misleading
CryptoBilis was reportedly listed by Ledger as an authorized reseller and operated in Malaysia, Indonesia, and the Philippines.techflowpost.com protos.com The available reports do not independently establish the exact duration of its listing as 'for years.'

This claim may mislead readers without added context.

Hackers inserted microscopic spy chips into the Ledger wallets.

Can’t verify
A suspected unauthorized hardware implant was reportedly found in one device, and images or examinations allegedly showed additional circuitry.crypto.news tftc.io Public reporting does not yet conclusively establish who installed it, whether it was present in all affected devices, or that it was accurately described as a 'microscopic spy chip.'

Assessment summary

  • The claim contains mostly accurate elements about the spy chip attack and $80M+ theft, but contains a critical misleading implication about the reseller's history and a technical inaccuracy about what was captured.
  • The reseller's ownership changed in March 2026, not years of malicious operation.
  • The chips captured recovery phrases, not private keys directly.

Claims reviewed

Silently capturing private keys

Misleading
The chips captured the 24-word recovery phrase displayed on screen, not private keys directly. While recovery phrases can unlock wallets, this is technically distinct from capturing private keys.

This claim may mislead readers without added context.

Listed for years

Misleading
While CryptoBilis may have existed for years, the reseller's ownership changed in March 2026, months before the thefts. The claim implies years of malicious operation by the same actors, which is not established.

This claim may mislead readers without added context.

Inserting microscopic spy chips into Ledger Bitcoin wallets

Verified
Ledger confirmed an unauthorized hardware implant in at least one device. The chips were small circuit boards with cellular capabilities, though they affected multiple cryptocurrencies, not just Bitcoin.

Assessment summary

  • Parts of the statement match current reporting about a large suspected supply‑chain theft tied to an authorized reseller in Southeast Asia.
  • Key technical details (exact mechanism, scope limited to Bitcoin, and the length of time the reseller was listed) are either unconfirmed or misstated.

Claims reviewed

This affected only Bitcoin wallets

Incorrect
Reporting and on‑chain analysis show funds were taken across multiple blockchains (Ethereum, TRON, USDT on Tron and others), not just Bitcoin.

This claim may mislead readers without added context.

Hackers stole over $80M by inserting microscopic spy chips into Ledger wallets

Misleading
On‑chain investigators and news outlets estimate losses in the tens of millions (reports range roughly $72M–$93M) and Ledger has confirmed investigation and at least one physically tampered device, but the precise theft amount and that every loss was caused by spy‑chip insertion are not fully verified.

This claim may mislead readers without added context.

Devices came from an official authorized reseller in Malaysia that was listed for years

Can’t verify
The reseller CryptoBilis is listed by Ledger as an authorized reseller for Malaysia (and other SEA countries), but publicly available sources do not clearly show how long it had been listed or prove a multi‑year listing timeline.

Check your own claim

Paste any statement, headline, or AI answer. Independent assessments check it and compare sources.

Share this result