Ledger Flex Device Linked to More Than $86 Million in Crypto Theft Found With Spyware

A Ledger Flex purchased at a Singapore airport contained an implanted spyware module, and similar devices have been tied to more than $86 million in stolen crypto assets, former Mt. Gox CEO Mark Karpelès confirmed Oct. 13.

The device was purchased by Ben Yorke this summer but had never been used. Yorke sent it for disassembly after noticing suspicious scratches on the casing.

The teardown revealed an additional circuit board and wiring concealed in the lower part of the hardware wallet. The implant was described as a newer design that could monitor communications involving the device’s screen while a user entered a recovery phrase, potentially exposing the phrase.

Ledger devices purchased through a Malaysian distributor were previously linked to thefts exceeding $86 million. Similar signs of tampering were also found in devices bought through official European distributors and in the Philippines.

The implants appear to have evolved from manually soldered components into more discreet, mass-produced circuit boards. The findings raise an immediate security warning for Ledger Flex users, particularly those who notice physical damage or other irregularities before setting up a device.