Ledger confirms hardware implant in reseller wallet

TLDR

Ledger has confirmed an unauthorized hardware implant in one customers wallet sold by reseller CryptoBilis, raising serious supply chain concerns for hardware wallets.

1. Ledger found a hidden electronic module in a CryptoBilis-sourced device, but has not proven it caused the large reported fund losses.
2. Independent on chain analyses put thefts between 86 and 93 million dollars across hundreds of wallets, while Ledger says its own infrastructure shows no sign of compromise.
3. Users with devices from CryptoBilis or unofficial channels should assume elevated risk and follow Ledgers guidance on replacing devices and securing recovery phrases.

Confidence: moderate because the implant is confirmed in one device but loss totals and attack method remain unverified.

Deep Dive

1. What Ledger Confirmed

Ledger has stated that one affected customers hardware wallet contained an unauthorized hardware implant, strengthening evidence of physical tampering in the supply chain linked to reseller CryptoBilis in Southeast Asia. This confirmation appears in multiple reports citing Ledgers support updates, including a situation note that the reseller has stopped selling all hardware wallet inventory as a precaution.

Technical photos shared by Mark Karpels show a Ledger Nano X with a concealed circuit board and cellular components under the screen padding, a design allegedly capable of intercepting recovery words during setup and transmitting them remotely. However, investigators have not shown that this particular device or implant design is definitively responsible for the thefts, and Ledger has not said that multiple devices were found with identical hardware.

2. Scale And Remaining Uncertainty

On chain researchers and analytics firms estimate losses between roughly 86 and 93 million dollars in Bitcoin, Ethereum, Tron, stablecoins and other assets across hundreds of wallets, with one analysis tallying about 92.9 million dollars across 311 addresses. Tether has reportedly frozen around 10 million dollars in linked USDT, limiting further movement from some attacker wallets but not automatically restoring funds to victims.

Ledger itself has not confirmed any specific total or wallet count and continues to say it has no indication that its security infrastructure, systems or services were compromised. On chain patterns show coordinated drains and earlier test transactions, suggesting a single point of control, but they do not reveal exactly how attackers obtained keys or recovery phrases. A separate Google ads based phishing campaign impersonating Ledger has also been documented, and there is currently no proven link between those fake sites and the CryptoBilis devices.

3. User Safety And Next Steps

Ledger has advised customers who bought devices from CryptoBilis in the last 90 days not to initialize unused units and to consider moving assets from already initialized devices to a new Ledger signer with a freshly generated recovery phrase. More broadly, the company reiterates that it will never ask for the 24 word phrase and that entering those words into any website, app or verification page gives full control of funds to whoever receives them.

For hardware wallet users, key practical checks now include buying directly from the manufacturer or trusted channels, inspecting packaging and devices carefully, and treating any request for a seed phrase as a red flag. The investigation will focus on how many devices were tampered with, whether implants were active as described, and who controlled the modified hardware.

Conclusion

Ledgers confirmation of a hardware implant in one reseller wallet solidifies a physical supply chain angle in a large theft case, but it does not yet explain the full loss pattern. For crypto users, the incident is a reminder that hardware security depends not just on device design but also on how and where the device is sourced, and that recovery phrase protection remains the ultimate line of defense while the investigation proceeds.