Ledger confirms hardware implant in drained wallets

TLDR

Ledger has confirmed that an unauthorized hardware implant was found in at least one affected hardware wallet tied to a reseller in Southeast Asia, but the full scope and cause remain unclear.

1. Ledger says one customer device had a hidden hardware implant and is probing large losses linked to reseller CryptoBilis, while insisting its own infrastructure was not breached.
2. Investigators describe a modified Ledger Nano X with a concealed cellular module that could spy on recovery words, but no proof yet that this exact method caused all the reported thefts.
3. Users who bought Ledgers via CryptoBilis or other third-party resellers face elevated supply chain risk and should follow Ledgers guidance, verify devices, and tighten recovery phrase hygiene.

Deep Dive

1. What Ledger Confirmed

Ledger stated on 10 Oct that one affected customers hardware wallet contained an unauthorized hardware implant in a case linked to Southeast Asian reseller CryptoBilis. That confirmation is reported by multiple outlets, including this detailed recap.

The incident is tied to users in Indonesia, Malaysia and the Philippines who bought devices from CryptoBilis, an authorized reseller. Various on-chain teams estimate suspected losses between about $72 million and $93 million across Bitcoin, Ethereum, Tron and other networks, but Ledger has not verified those figures or that the implant caused the drains.

Crucially, Ledger says there is no indication that its security infrastructure, systems or services were compromised, and current evidence points to a localized supply chain problem rather than a global vulnerability in all Ledger devices.

2. Suspected Attack Method

Former Mt. Gox CEO Mark Karpels shared photos and analysis of a Ledger Nano X with a hidden circuit board, antenna, eSIM and microcontroller installed under the screen padding, described in the same incident report.

Security researchers, including SlowMists CISO, speculate that such a board could tap the screens data line, read the 24-word recovery phrase as it is displayed during setup, then send it out over a cellular connection.

If that reconstruction is accurate, it would bypass checks that only verify Ledgers secure element chip, since the malicious hardware sits outside the secure core. However, investigators have not yet proven that all drained wallets used similarly modified devices or that this exact implant was active in every case.

3. How Users Should Respond

Ledger has asked CryptoBilis to halt all hardware wallet sales while the investigation continues and specifically advised customers who bought from that reseller in the past 90 days not to initialize unused devices.

For users who already set up affected devices, Ledgers guidance is to consider moving assets to a new Ledger signer created with a brand new recovery phrase, since reusing the old phrase recreates the same private keys.

More broadly, this case reinforces best practices: buy hardware wallets directly from the manufacturer or highly trusted channels, inspect packaging, run genuineness checks, and never share or type your 24-word recovery phrase into anything other than the hardware device itself.

Conclusion

Ledgers confirmation of a hardware implant makes a localized supply chain attack the leading hypothesis, but it does not yet fully explain the tens of millions allegedly drained. For now, the practical takeaway is to treat third-party hardware wallet channels with caution, follow Ledgers official guidance if you bought via CryptoBilis, and tighten your operational security around how and where recovery phrases are ever displayed or stored.