Ledger Confirms Spy Chip Implant Behind Wallet Crypto Thefts

TL;DR

Before you orderOffer from Amazon

Get hardware and tech essentials delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Ledger says user reports of unexpected cryptocurrency losses were linked to devices sold through Southeast Asian reseller CryptoBilis, and confirmed that at least one affected device contained an unauthorized hardware implant. Researchers have described implants that could capture screen information and button presses, but Ledger has not confirmed the devices’ model or the precise theft method. The company advises buyers who have not set up a device from the reseller not to do so.

Ledger has linked all user reports of unexpected cryptocurrency losses in its investigation to devices sold through Malaysia-based reseller CryptoBilis, and confirmed that at least one affected wallet contained an unauthorized hardware implant. The company has not publicly confirmed the exact device model or how the tampering led to the reported thefts, and says its investigation is ongoing.

Ledger began investigating after customers reported funds disappearing from wallets purchased through CryptoBilis, a hardware wallet retailer operating across Southeast Asia. On October 9, the company said it had asked the reseller to stop selling and shipping Ledger devices. The following day, Ledger confirmed an implant had been found in one affected user’s device and said it was contacting impacted users.

In a later update, Ledger said all reports of unexpected fund drains it had received were linked to devices sold through CryptoBilis. It described the affected volume as “limited” but did not publish a figure. Ledger said it was working with authorities to identify the person responsible. The exact number of affected devices and the amount of cryptocurrency lost have not been disclosed in the source material.

Security researchers and online investigators have described suspected implants in Ledger Nano X devices. Research studio Tibane Labs said it examined two variants, while Mark Karpelès shared an image of an implant he said was concealed behind a device screen. Their findings are separate from Ledger’s public confirmation: the company has not identified the model involved or verified all details of the researchers’ analysis.

Risks in Wallet Resale Channels

The reports highlight a security risk that differs from a software flaw: a hardware wallet can be altered before it reaches its buyer. Ledger devices are designed to hold the private keys that control crypto assets and authorize transactions. If a malicious modification can expose information used to access those keys, the device’s physical security may not protect the owner as expected.

The case also puts pressure on the reseller and distribution chain. Ledger advises buyers to use authorized channels and tells its distributors to source products through approved routes and avoid restocking returned devices. The company’s “Genuine Check” can help verify a device, but Ledger warns that it cannot detect an added implant if the original Secure Element remains intact.

Ledger has characterized the reported volume as limited, and the available material does not establish that other resellers are involved. Even so, the incident may affect customer confidence in third-party listings, particularly where a device’s origin and handling cannot be independently verified. Crypto assets can be volatile and losses may be difficult to recover; this report is not financial advice.

How the Implant Was Described

Researchers have described hardware modifications that fit inside the wallet casing and use a small cellular connection. Tibane Labs reported that one variant replaced the original battery with a smaller one, making room for additional circuitry, including a microcontroller, an eSIM and a shielded LTE module. The researchers said another variant used the space beneath the screen and retained the original battery.

Karpelès said the device he examined could capture screen output and button presses to identify a seed phrase, then send the information over an LTE connection. Tibane Labs’ findings offered a similar account of how the hardware might communicate. These are researchers’ descriptions of examined specimens, not a public technical account from Ledger of the attack mechanism. The source material does not establish that every device linked to a loss contained the same design.

The devices reportedly appeared through third-party marketplaces and sellers, including listings described as shipped from Malaysia. Ledger has not said exactly when or where the affected devices were modified, or established who supplied each one. Its warning is focused on CryptoBilis purchases, and the available information does not show that other Ledger reseller channels have distributed compromised units.

““Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant.””

— Ledger

Unanswered Questions About Tampering

Several key details remain unknown. Ledger has not disclosed how many devices were compromised, how much cryptocurrency users lost, or how many customers have been contacted. It has also not explained when the implants were installed, how the devices entered the reseller’s inventory, or who carried out the tampering.

Researchers have described suspected Nano X implants and possible methods for capturing and transmitting seed information, but Ledger has not publicly confirmed that account as the mechanism behind every reported loss. The company has also said its authenticity check cannot detect an implant when the original Secure Element remains intact, limiting what buyers can infer from that check alone.

The source material reports no indication that other Ledger resellers shipped compromised wallets. That does not resolve whether devices elsewhere in the distribution chain were examined or whether further cases will emerge. Ledger’s investigation and work with authorities are continuing.

Ledger’s Investigation and User Guidance

Ledger says it is contacting impacted users and working with authorities to identify the perpetrator. The company has not provided a public timetable for the investigation or announced a final account of how the devices were altered. Further updates may clarify the number of affected customers, the losses reported and whether the suspected implant findings match the devices involved in the company’s cases.

For customers who bought through CryptoBilis and have not set up their device, Ledger advises not to begin setup. For those who have already set one up, the company says to consider moving assets to a new Ledger signer with a new seed. That is Ledger’s guidance in the source material; users should consult the company’s current instructions and assess the risks of any transfer before acting.

Ledger is also telling authorized resellers and distributors to obtain products through authorized channels and not to restock returned devices. Until the investigation provides more detail, buyers should treat the reported incident as tied to the named reseller rather than as proof that all Ledger devices or other resellers are affected.

Key Questions

What did Ledger confirm?

Ledger confirmed that at least one affected user’s device contained an unauthorized hardware implant. It later said all user reports of unexpected fund drains it had received were linked to devices sold through CryptoBilis.

Has Ledger confirmed the device model?

Not in the information provided. Researchers have discussed suspected Ledger Nano X devices, but Ledger has not publicly named the model involved in its confirmation.

What should a CryptoBilis buyer do?

Ledger advises customers who have not set up a device bought through CryptoBilis not to initiate setup. For customers who have already set one up, Ledger says to consider moving assets to a new signer with a new seed.

Can Ledger’s Genuine Check find an implant?

Ledger says its Genuine Check cannot detect added implants when the device’s original Secure Element remains intact. The company recommends buying through authorized channels.

Are other resellers known to be affected?

The source material says there is no indication that other Ledger resellers have shipped compromised wallets. Ledger’s investigation is ongoing, so the available information does not settle whether additional cases will be found.

Source: hn