"Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant," Ledger said, announcing what it called a confirmed case of tampering tied to recent wallet thefts.
Ledger confirms tampering and narrows the failure to one reseller
Ledger began investigating reports of users losing cryptocurrency on October 9 after receiving complaints tied to wallets purchased through CryptoBilis, a Malaysia-based hardware wallet retailer operating across Southeast Asia. The company asked CryptoBilis to stop selling and shipping Ledger devices and on October 10 confirmed that at least one device contained an unauthorized hardware implant. Ledger said it is reaching out to impacted users, working with authorities to identify the perpetrator, and warned that users who purchased devices from this reseller should not initiate setup and that those who already set up a device should "consider moving assets to a new Ledger signer (with a new seed)." In a subsequent update, Ledger said all reports of unexpected fund drains were linked to devices sold through CryptoBilis and described the affected volume as "limited."
The Ledger X spy implant — two variants documented by researchers
Independent researchers began showing a spy implant in Ledger X devices as early as September 16, claiming tampered devices were being sold for nearly half the price of legitimate hardware. Mark Karpelès, currently leading Karpeles Lab Inc. and CTO at Shells.com, published a picture of a new implant in Ledger X and called it "quite an evolution" from earlier versions that used manually soldered wires. Tibane Labs, a cryptocurrency research and development studio, confirmed Karpelès’ finding and reported two distinct implant variants in Ledger X units. One specimen was purchased on Amazon Japan from a "China-based seller · shipped from Malaysia;" another came from Yahoo! Auctions, Japan.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleResearchers’ technical findings: small MCU, tiny eSIM, and an LTE link
Analysis by Tibane Labs showed the attackers made room for malicious circuitry by replacing the original battery with a smaller one in one variant, and by fitting a compact implant into the foam padding under the OLED screen in the other. Under the battery and antenna of one device the researchers found an ST STM32G431KBU6 (Arm Cortex‑M4, 128 KB flash, UFQFPN‑32). For connectivity the actor used "a tiny eSIM, an 8‑pad package just 2×2 mm, next to the MCU, and a shielded LTE module that sends the words out," the report said. In the second device the MCU and eSIM part markings had been scraped off to conceal identifiers. In both examples the antenna cable was the telltale indicator: taped along the top of the battery in one specimen and running along the top edge in the other.
How the implant reportedly worked, according to researchers and Karpelès
Researchers and Karpelès described a clear functional model: the malicious hardware captured the device's display output and button presses to identify the recovery seed phrase, then transmitted that sensitive data to the attacker over an LTE connection using the embedded eSIM. Karpelès summarized the consequence plainly: "Ledger Nano X are used to store crypto. The spy implants are used to steal whatever crypto you store in those Ledger Nano X." Tibane Labs also noted that the implant boards appeared professionally manufactured — "a designed, panelised flex PCB, the kind ordered from a board house, not a hand-built one-off" — indicating a deliberate, repeatable supply-chain modification rather than an amateur one-off.
What this means for end users, authorized resellers, and investigators
- End users: Ledger explicitly advised buyers who obtained devices from CryptoBilis to avoid setup; those who already set up affected devices were urged to move assets to a new Ledger signer with a new seed. Ledger also highlighted that its 'Genuine Check' mechanism cannot detect added implants when the device’s original Secure Element remains intact.
- Authorized resellers and distributors: Ledger reminded its network to source products only through authorized channels and to avoid restocking returned products, warning that unauthorized resellers increase the risk of counterfeit or modified devices.
- Investigators and law enforcement: Ledger said it is working with authorities to identify and prosecute the perpetrator. Researchers’ finding of professionally panelised flex PCBs, a marketed eSIM package, and MCU components with scraped markings suggests an organized actor with access to component procurement and board fabrication.
The immediate facts are stark: a confirmed hardware implant, a single reseller identified as the common link in reported thefts, and technical analyses from multiple researchers that describe how an implant could harvest a seed phrase and phone it home over LTE. What remains publicly unclear — and what Ledger acknowledged in its initial statements — is exactly when and how the devices were tampered with during the supply chain. For users and forensics teams, the presence of a physically concealed antenna wire and nonstandard internal parts will now be as important as the device’s software-visible integrity checks.
