Ledger identifies hardware implant behind wallet drains

TLDR

Ledger has confirmed that at least one customer hardware wallet contained a hidden hardware implant tied to a wave of wallet drains linked to a Southeast Asian reseller.

1. Ledger found an unauthorized hardware implant in a device sold via reseller CryptoBilis amid reported losses between roughly 86 million and 94 million dollars, but the exact causal link is not fully proven yet.
2. The implant appears to be a sophisticated supply chain tampering of specific devices, while Ledger says its core infrastructure and services remain uncompromised.
3. Risk is currently scoped to customers who bought from CryptoBilis, with investigators tracking stolen funds through mixers, and users are being urged to treat potentially affected devices as untrusted.

Deep Dive

1. What Ledger Found

Ledger reported that one affected user's hardware wallet contained an "unauthorized hardware implant" in a device purchased through Southeast Asian reseller CryptoBilis, an authorized partner in Indonesia, Malaysia and the Philippines. Reports estimate the associated wallet drains at between about 86 million and 94 million dollars across Bitcoin, Ethereum, Tron and stablecoins, although Ledger has not confirmed a final loss figure or number of impacted devices.

Security researchers and media describe this as the first concrete evidence of physical tampering in the investigation into CryptoBilis linked wallet drains, not a software or firmware bug on Ledger's side.

2. How The Implant Likely Worked

Photos and teardown notes from investigators describe a modified Ledger Nano X containing concealed circuitry, including a cellular module, antenna, eSIM and microcontroller placed near the screen assembly. Analysis suggests the implant could intercept data sent to the display during setup and transmit recovery phrase words over a cellular connection, allowing thieves to reconstruct private keys while the device still passes normal usage checks.

However, investigators have not yet shown that all drained wallets used similarly modified devices, nor definitively tied this specific implant to every theft, so some details of the attack chain remain uncertain.

3. Who Is At Risk And What To Watch

So far, the incident appears concentrated among users who bought Ledger devices from CryptoBilis in recent months. Ledger asked that reseller to halt sales and has advised those customers not to initialize unused devices, and to consider migrating funds from already initialized ones to a fresh signer with a new recovery phrase.

Investigators have tracked parts of the stolen funds through chains and privacy tools, including thousands of ETH moved through Tornado Cash and conversions routed via NEAR and Zcash, indicating an active laundering effort.

Conclusion

Ledger's discovery of a hardware implant in at least one customer device points to a targeted supply chain attack against a reseller, not a direct break of Ledger's core cryptography. For crypto users, the main takeaway is that self custody security depends not only on the wallet brand, but also on how and where the device is obtained, how recovery phrases are handled, and staying alert to official advisories when large scale thefts surface.