An attacker does not have to crack a hardware wallet’s security chip if the device is about to display the secret. In the reported Ledger implant case, an added circuit copied the recovery phrase from the screen during setup and sent it over a mobile network. Ledger’s security team said the Secure Element and operating system were intact. The words were shown on a screen, and the screen had an audience.

For years, we have heard stories about mysteriously drained wallets: the owner still had the hardware wallet, had not typed the recovery phrase into a website, and could not explain where the coins had gone. A copied backup or a phishing page could explain some cases. It was also easy to assume the owner had simply forgotten, or omitted, a mistake.

That mechanism could explain at least some of those older stories without anyone guessing a private key or the owner entering the phrase on a computer. It does not tell us what happened in any particular earlier case. It does show why “I never typed my seed anywhere” is not the end of the investigation.

After the news, a few colleagues asked me about websites claiming to contain a “database of all Bitcoin private keys.” If every possible key was already on a website, were our wallets safe? Was this how the money had disappeared?

Those questions are why I started this series. Before counting private keys, though, we need to establish what the device checks actually tell us.

What the incident reports establish

Incident account checked on October 15, 2026; the investigation remains open.

The reported losses involved devices bought through CryptoBilis, a Southeast Asian reseller listed in Ledger’s official directory 1, 4. Authorized status had not prevented the reported tampering. Ledger asked the reseller to pause sales and shipments, and the October 13 report describes the company’s findings and advice to affected buyers 1. I have not examined an affected device.

Bitquery’s investigation, marked verified October 15, estimates $102.0 million taken from 324 wallets on six chains, with $10 million in USDT frozen by Tether. These are Bitquery’s attribution and valuation of the flows, rather than a Ledger-confirmed victim count. Transaction traces show where funds went; they cannot establish where a physical device was altered.

Before you initialize the device

Ledger’s buying guide gives a practical starting point:

  • Check the seller and package. Verify the seller against the manufacturer’s authorized list. If the package looks opened or altered, stop and contact support.
  • Check the setup state. A new device should not arrive with a supplied PIN or recovery phrase. The device should generate the words during your setup; record them privately.
  • Use the official software. Download the app from the manufacturer’s site or official app store and run Genuine Check. Never enter the recovery phrase into an app or website.

Genuine Check authenticates the Secure Element. It cannot detect an added spying implant when that original chip remains intact 3. Authorized sourcing, intact-looking packaging, and a passing check do not amount to a hardware audit.

Establishing whether a particular device is trustworthy requires examining its hardware, firmware, and handling of secrets. Here we can work through the wallet derivations and the mathematics of guessing: count the possible inputs, follow how they become keys, and calculate probabilities under stated assumptions. Those calculations do not certify an unknown implementation, but they let us explain precisely what correctly generated secrets protect against.

Randomness, entropy, and keeping a secret

For key generation, randomness has to make the choice unpredictable to an attacker. Appearance is a poor test. A string derived from a clock value can look just as untidy as one drawn from a secure source.

Entropy measures uncertainty. Four fair, independent coin flips have 16 equally likely outcomes: four bits of entropy. Another independent fair flip doubles the possibilities. For N equally likely outcomes, entropy is log2(N) bits:

Choice Equally likely possibilities Entropy
One fair coin flip 2 1 bit
Four independent fair flips 16 4 bits
A uniform 32-bit seed 4,294,967,296 32 bits

The qualifications do work here. Biased or dependent flips do not supply one new bit each. Information already available to an attacker reduces the uncertainty that remains. Counting possible outputs can therefore overstate the difficulty of guessing a secret; NIST’s entropy-source guidance uses measures such as min-entropy to account for this 6.

Suppose a fixed algorithm expands a 32-bit seed into a 256-bit key. It can produce at most 2^32 different keys. Hashing the seed, printing more digits, or turning it into words cannot add input possibilities. The next question is how much work the attacker must do to test each possibility.

Deterministic generation is normal in cryptography. A cryptographically secure pseudorandom number generator (CSPRNG) expands secret state into outputs designed to resist prediction, provided the state has enough entropy and the implementation is sound 7. Python’s secrets module uses the operating system’s secure source; random serves simulation 8. Neither can make a small, guessable initial seed impossible to enumerate.

Then there is confidentiality. A correctly generated secret can still be copied from a display, recovery entry, or backup. Once the attacker has it, there is nothing left to guess. The reported implant crossed that boundary without needing to change the key-generation algorithm.

Five posts, three failure stages

I wrote the scripts accompanying this series to put numbers behind that question. The companion repository, entropy-lab, contains the scanner, RNG models, and synthetic benchmarks. The series starts by explaining the key directory, follows the wallet-generation stack, and ends with measured searches:

Part Question
1 — The database of all private keys How can a website show every key without storing them?
2 — Seed phrases and entropy What changes between 12 and 24 words, and what does a seed recover?
3 — The scanner experiment What do four bounded candidate searches find in a funded-address snapshot?
4 — When randomness fails Where have real generators failed, and what can a synthetic benchmark establish?

Keep three stages separate as we go. Weak generation makes a key guessable. A signing failure can expose an otherwise strong key. Copying the recovery secret bypasses both. Calling all three “broken cryptography” hides the part that needs fixing.

Public keys on demand, public addresses on disk

The raw ingredients sound alarming. keys.lol displays private keys and their addresses. The retired directory.io keeps its original first page as a demonstration. Public datasets list funded addresses and historical address use 5. Put a candidate generator on one side and a funded-address list on the other, and you have a search pipeline.

The active directory calculates its pages on demand. It has not obtained anyone’s secret. Part 1 shows the arithmetic; the page count alone needs 75 digits.

For Part 3, the funded-address snapshot contains 57,205,029 entries, dated October 13, 2026. The scanner derives compressed and uncompressed legacy Pay-to-Public-Key-Hash (P2PKH) addresses for each candidate key. Of the snapshot entries, 21,198,062 start with 1, the legacy P2PKH prefix; this count classifies prefixes without validating checksums.

The four runs covered 1.5 million random keys, just over a million patterned integers, 104,334 dictionary brainwallets, and all 16,777,216 seeds in a synthetic 24-bit generator. None produced a funded-snapshot prefix flag. Known, drained addresses served as separate positive controls. Part 3 explains the index, its verification limit, and why this result covers only the tested address forms at that snapshot date.

Protecting the secret after setup

The reported implant gives us a useful way to read the rest of the series. Entropy protects against guessing. Every point where a secret appears needs protection against copying.

Later recovery entries, displays, and backups create further opportunities to copy the phrase. For CryptoBilis purchases, the October reports relay Ledger’s advice to leave unused devices uninitialized and move assets from used devices to a new device with a newly generated phrase 1. Consult current manufacturer guidance before acting on this continuing incident.

Adding words does not protect a complete phrase after someone has copied it. A separately protected BIP39 passphrase changes what those words alone can unlock; Part 2 follows that distinction through the derivation stack.

There is an observable result at the other end of the series. A synthetic benchmark made 50 billion probes against a planted synthetic target set and counted 174 matches, against 186.26 expected. The idealized 128- and 256-bit controls each made 50 billion probes and counted zero. Part 4 explains why the planted count is useful evidence, while the zero counts cannot certify a real entropy source.

First, the website that claims to have all the keys.

Sources

  1. CoinDesk, October 13, 2026 — Ledger’s reported findings on the CryptoBilis hardware implant.
  2. Bitquery — Ledger CryptoBilis on-chain investigation, figures marked verified October 15, 2026.
  3. Ledger — Buying guidance and the limits of Genuine Check.
  4. Ledger — Authorized reseller directory, rechecked October 16, 2026.
  5. Public address datasets — funded addresses (maintainer’s project thread) and historical address use.
  6. NIST — SP 800-90B: entropy-source assessment.
  7. NIST — SP 800-90A Rev. 1: deterministic random-bit generators.
  8. Python 3.13 — secrets documentation.