Ledger Confirms Spy Chip Implant Behind Wallet Crypto Thefts

TL;DR

Before you orderOffer from Amazon

Get privacy and security gear delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Ledger says all user reports of unexpected cryptocurrency withdrawals under investigation involved devices sold through Southeast Asian reseller CryptoBilis. It confirmed an unauthorized hardware implant in at least one device, while researchers have described implant variants that may capture wallet information; Ledger has not publicly confirmed those technical findings or identified the affected models.

Ledger has confirmed that at least one device containing an unauthorized hardware implant was linked to reports of cryptocurrency theft involving wallets bought through Southeast Asian reseller CryptoBilis. The company later said all user reports of unexpected fund withdrawals in its investigation involved devices sold by the retailer, but has not disclosed how many devices or users were affected.

Ledger said on October 9 that it had opened an investigation into user reports of funds disappearing from wallets purchased through CryptoBilis and asked the reseller to stop selling and shipping Ledger devices. On October 10, it confirmed that one impacted user’s device contained an unauthorized hardware implant. The company has not said when or where the hardware was altered.

In a later update, Ledger described the number of affected reports as “limited” and said every report of unexpected withdrawals it had received in the investigation concerned a device sold through CryptoBilis. Ledger has not identified the compromised models or published a complete count of devices, customers or stolen funds.

Security researchers have separately examined devices they describe as modified Ledger Nano X wallets. Mark Karpelès and researchers at Tibane Labs reported finding hidden components, including cellular connectivity hardware, in samples obtained through other marketplaces. Their analysis suggests the implant could capture information displayed on the device and button inputs. Those technical findings are researchers’ claims about examined samples; Ledger has not publicly confirmed that the devices they inspected are the same units linked to its customer reports.

Risks From Reseller-Sourced Wallets

The reports challenge a basic assumption behind hardware wallets: that a physical signing device bought through a seller can be trusted to protect the information needed to control crypto assets. A modified device could expose users to theft even if the wallet’s standard software and security checks appear to function normally.

For customers, the immediate concern is not that Ledger has said all its products are affected—it has not—but that the company connected the reports it investigated to one reseller. The incident also highlights limits to device authenticity checks. Ledger says its Genuine Check can confirm aspects of a device’s authenticity, but warns that it cannot detect an added implant if the original Secure Element remains intact.

The case may also affect confidence in distribution networks. Ledger has advised buying through authorized channels, and the company’s investigation could shape how it and its distributors handle returned stock and verify supply chains. At present, Ledger has reported no indication that other resellers are shipping compromised wallets.

How the Investigation Developed

Ledger hardware wallets are physical devices intended to keep private keys—the credentials that control cryptocurrency—offline and authorize transactions. CryptoBilis is described in the reporting as a Malaysia-based retailer serving customers across Southeast Asia. Ledger’s public response began after users reported losses from devices bought through the reseller.

Researchers’ findings add technical detail but do not settle the origin or scope of the incident. Tibane Labs said it examined two variants in devices acquired through separate marketplaces in Japan, one described as shipped from Malaysia. Its report describes circuitry placed beneath a device’s battery or display area and an antenna wire. Karpelès also published an image of an implant he said was concealed behind a screen. These samples and acquisition routes do not, on their own, establish that the same seller or supply chain was involved in every customer case.

Ledger has urged customers who bought from CryptoBilis and have not started setup not to initialize the device. For customers who have already set one up, the company recommends considering a move of assets to a new Ledger signer using a new seed phrase. It is also working with authorities to identify the person responsible.

““One of the impacted users’ devices contained an unauthorized hardware implant.””

— Ledger

Scope and Implant Details Unclear

Ledger has not disclosed the number of affected devices, users or stolen assets, and it has not publicly confirmed which Ledger models were involved. The company also has not explained how the devices were tampered with, when that happened, or whether the implant described by researchers matches the hardware found in the customer case it confirmed.

It remains unclear how CryptoBilis obtained the affected stock and whether the retailer knowingly handled modified devices. Ledger has asked authorities to help identify the perpetrator; no suspect or public account of responsibility is provided in the source material. Researchers’ reports of samples bought through other marketplaces should not be treated as proof that those sellers were involved in Ledger’s reported cases.

Ledger says its authenticity check cannot identify an added implant when the original Secure Element remains intact. The company has not announced a method that customers can use to rule out this type of tampering in a device already purchased.

Ledger and Authorities Continue Probes

Ledger says its investigation is ongoing and that it is contacting affected users while working with authorities. The next significant information would be a clearer account of which devices and transactions were affected, how the tampering occurred, and whether investigators can identify the person or group responsible.

Customers who purchased through CryptoBilis should follow Ledger’s published guidance and seek support through the company’s official channels. Ledger has also told authorized resellers and distributors to obtain products only through authorized channels and not to restock returned devices. Whether those steps will change reseller checks or lead to further public findings has not yet been announced.

Key Questions

What has Ledger confirmed?

Ledger confirmed an unauthorized hardware implant in at least one device linked to a customer’s reported losses. It later said all unexpected-withdrawal reports in its investigation involved devices sold through CryptoBilis.

Has Ledger confirmed that every affected wallet was a Nano X?

No. Researchers have described implants in devices they identified as Ledger Nano X models, but Ledger has not publicly named the models involved in its customer cases.

What should CryptoBilis customers do?

Ledger advises customers who have not set up a device bought from the reseller not to begin setup. If they have already set it up, Ledger recommends considering a transfer to a new Ledger signer with a new seed.

Can Ledger’s Genuine Check detect an implant?

Ledger says the check can verify device authenticity but cannot detect an added implant if the original Secure Element remains intact.

Are other Ledger resellers known to be affected?

Ledger has said there is currently no indication that other resellers are shipping compromised wallets. The investigation is ongoing, and the company has not published a complete account of the affected supply chain.

Source: hn