- Ledger confirmed that at least one wallet sold through the reseller CryptoBilis contained an unauthorized hardware implant, and says all reported fund drains trace to that reseller.
- Ledger's Genuine Check does not detect added implants when the original Secure Element is intact, so a passed check does not prove the device is clean.
- Buy security hardware only from the maker's authorized channels, and verify the seller before accepting a deep discount.
A hardware wallet is bought to answer one question: can anyone else get my keys? Ledger has now confirmed that, for at least one customer, the answer was yes. The device had a hidden implant. The lesson reaches past crypto. A security product is only as trustworthy as the path it took to reach you.
What Ledger has confirmed, and what it has not
BleepingComputer reported on October 12 that Ledger had investigated user reports of lost funds. On October 9, Ledger asked the Southeast Asian reseller CryptoBilis to stop selling and shipping its devices. The next day, Ledger said one affected user's device "contained an unauthorized hardware implant."
Ledger later said every report of unexpected fund drains was tied to devices sold through CryptoBilis. It described the affected volume as "limited." It is working with authorities.
Several things remain unknown. The method and timing of the tampering are still unclear. Ledger did not say which model was affected.
BleepingComputer notes there is no indication that other Ledger resellers are shipping compromised wallets. It adds that community trust in the reseller network has been damaged.
How the reported implant works
A Ledger wallet keeps the private keys that authorize crypto transactions inside a protected chip. The device also gives users a seed phrase, a list of recovery words that can rebuild those keys anywhere. Whoever has the phrase controls the funds.
Online reports describe a spy implant in Ledger X devices. Mark Karpelès, a former Mt. Gox CEO, said the implant captured the display output and button presses to work out the seed phrase. It then sent the phrase to the attacker over an LTE mobile connection, using an eSIM.
These are researchers' accounts. Ledger did not name the affected model. It has not said that the hardware they describe is the same as the implant in the CryptoBilis device.
If the researchers are right, the attacker did not need to break the protected chip. The phrase must be shown to a person, and the implant reportedly watched the display and buttons. Strong locks do not help when someone is watching the keyholder.
A professional build, not a one-off
Tibane Labs, a crypto research studio, examined two implant variants. It bought one on Amazon Japan from a China-based seller shipping from Malaysia. It bought the other on Yahoo! Auctions in Japan. Tibane did not say these came from CryptoBilis, and Karpelès did not name the vendor of his device either.
In the first variant, the attacker swapped in a smaller battery to make room. Under it sat an ST STM32G431KBU6 microcontroller, a small general-purpose processor. Beside it were a tiny eSIM and a shielded LTE module. In the second variant, markings on the processor and eSIM had been scraped off to hide part numbers. It kept the original battery and sat in the space normally filled by foam under the screen.
Tibane said the second specimen used "a designed, panelised flex PCB, the kind ordered from a board house, not a hand-built one-off." Karpelès called it "quite an evolution" from earlier versions with hand-soldered wires. That points to a repeatable process. The sources do not say how many units exist.
Why the check does not settle it
Ledger offers a Genuine Check to confirm a device is authentic. By Ledger's own account, the test has a blind spot. If the original Secure Element is left in place, added hardware can pass unnoticed. The check confirms the chip is real. It does not confirm that nothing was added beside it.
The price was also a signal. Researchers said tampered devices sold for nearly half the original price. A deep discount on a security product calls for a closer look at the seller.
Individuals carry the cost. The implant reportedly captured the seed phrase as it was displayed. If so, following every on-screen step would not have protected a buyer. Ledger now tells people who bought from this reseller not to start setup. Buyers who have already set up a device are advised to move their funds to a new Ledger signer with a new seed.
What leaders should ask
This applies to any organization that holds digital assets or buys security hardware. Put these questions to your team.
First, where did every signing device, hardware key and token come from? Only authorized channels count. Ledger says unauthorized resellers carry a higher risk of counterfeit or modified devices.
Second, who handles returns? Ledger reminds its authorized resellers to avoid restocking returned products.
Third, does the verification we rely on check the whole device, or only one part? Ask for the limits of any authenticity check in writing.
Fourth, what is the plan if a device is suspect? That means moving assets and generating new seeds, not just replacing hardware.
A sealed box and a passed check are not the same as a trusted supply chain. The cheapest protection here costs nothing: buy from the maker's channels and verify any seller who offers a deep discount.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: BleepingComputer.
