Ledger has confirmed that hardware wallets sold through CryptoBilis, a major Southeast Asian reseller based in Malaysia, were fitted with malicious circuitry that siphoned cryptocurrency from users' accounts. The company began investigating after receiving reports of fund losses from customers who purchased devices through the retailer, which operates across the region.
Researchers first documented evidence of the implant in Ledger X devices starting September 16, noting that the tampered units were being offered at roughly half the legitimate retail price. Ledger Nano X devices function as hardware wallets, storing the private cryptographic keys needed to control digital assets and authorize transactions.
On October 9, Ledger initiated a formal investigation into user reports of cryptocurrency losses and instructed CryptoBilis to cease all sales and shipments of Ledger devices. The following day, the company confirmed that at least one affected device contained an unauthorized hardware implant, though the precise timing and method of tampering remained unclear.
Ledger can confirm that one of the impacted users' devices contained an unauthorized hardware implant. Ledger is reaching out to impacted users as part of the ongoing investigation.
Ledger
Ledger stated it was collaborating with law enforcement to identify those responsible. The company advised users who obtained devices from CryptoBilis to refrain from initializing them if they had not yet done so, and recommended that those who had already set up their wallets transfer assets to a new Ledger device with a fresh seed phrase.
In a subsequent update, Ledger confirmed that all reported instances of unauthorized fund drainage were connected to CryptoBilis sales, characterizing the affected volume as "limited." While the company did not specify which device models were compromised, online discussions centered on spy implants discovered in Ledger X units that blended seamlessly with legitimate components.
Technical Details of the Implant
Mark Karpelès, former CEO of Mt. Gox and current leader of Karpeles Lab Inc. and CTO at Shells.com, published images of the spy implant in Ledger X devices, describing it as "quite an evolution" compared to earlier versions that relied on manually soldered wires. Karpelès noted that the implant was concealed behind the screen, though its antenna cable would have been visible to an attentive user.
According to Karpelès' analysis, the malicious hardware intercepted the device's display output and button inputs to extract the seed phrase, then transmitted the data to attackers via an LTE connection using an embedded eSIM. He explained that the implant's purpose was straightforward: "Ledger Nano X are used to store crypto. The spy implants are used to steal whatever crypto you store in those Ledger Nano X."
Karpelès did not identify CryptoBilis as the source but indicated the compromised device came from "a well known platform via a Chinese seller (product shipped from Malaysia)" rather than through Ledger's official distribution channels.
Tibane Labs, a cryptocurrency research and development organization, corroborated Karpelès' findings and identified two distinct implant variants for Ledger X devices. The researchers obtained samples from Amazon Japan (purchased from a China-based seller with shipment from Malaysia) and Yahoo! Auctions Japan.
Tibane Labs discovered that the threat actor created space for the malicious circuitry by replacing the original battery with a smaller unit that powered both the implant and the Ledger X itself. Inside one device, researchers found an ST STM32G431KBU6 microcontroller (Arm Cortex-M4 with 128 KB flash memory in a UFQFPN-32 package).
For wireless transmission, the attacker deployed "a tiny eSIM, an 8-pad package just 2×2 mm, next to the MCU, and a shielded LTE module that sends the words out." In the second device analyzed, markings on both the microcontroller and eSIM had been deliberately scraped away to obscure component identification numbers.
The second variant, which matches Karpelès' description, represented a more sophisticated design. It operated on the original battery and fit into the space normally reserved for foam padding beneath the OLED display. In both cases, the antenna wire served as a visible indicator of tampering—running along the top edge in the second implant and taped across the battery and shielded LTE module in the first.
Tibane Labs emphasized that the specimen used "a designed, panelised flex PCB, the kind ordered from a board house, not a hand-built one-off," indicating a professionally manufactured supply-chain attack rather than an improvised modification.
Recommendations and Broader Impact
Ledger is urging customers to purchase only from authorized resellers to minimize exposure to counterfeit or modified devices. The company is also reminding its authorized resellers and distributors to source products exclusively through official channels and to avoid restocking items that have been returned.
Ledger offers a 'Genuine Check' mechanism to verify device authenticity; however, the company explicitly cautioned that this tool cannot detect added implants if the device's original Secure Element remains functional.
Currently, no evidence suggests that other Ledger resellers are distributing compromised wallets. Nevertheless, the incident has eroded confidence in the reseller network, with members of the cryptocurrency community increasingly calling for its elimination.