Ledger has confirmed that certain devices distributed through the Southeast Asian reseller CryptoBilis contained an unauthorized hardware implant that enabled the theft of cryptocurrency from users’ wallets. The company began investigating after receiving reports of unexpected fund losses from wallets bought through CryptoBilis, a Malaysia‑based retailer operating across the region. On October 9, Ledger launched the investigation and asked CryptoBilis to halt sales and shipments of its products. The next day, Ledger confirmed that at least one affected device contained a hardware tampering element, though the exact timing and method of the compromise remain unclear.
According to Ledger’s statement, the implant was discovered in a user’s device and the company is contacting impacted users as part of the ongoing inquiry. Ledger also said it is cooperating with authorities to identify the perpetrator and pursue legal action.
Mark Karpelès, who leads Karpeles Lab Inc. and serves as CTO at Shells.com, shared an image of the implant found in a Ledger Nano X. He described it as an evolution from earlier versions that used manually soldered wires. Karpelès said the malicious circuitry was hidden behind the device’s screen, with an antenna cable that would have been visible if inspected. The implant, he explained, captures the device’s display output and button presses to extract the seed phrase, then transmits the data to an attacker over an LTE connection using an eSIM.
Tibane Labs, a cryptocurrency research and development studio, independently verified Karpelès’s findings. Their analysis revealed two versions of the implant. In one variant, the original battery was replaced with a smaller cell that powers both the implant and the Ledger X; underneath the battery and antenna lies an ST STM32G431KBU6 microcontroller (Arm Cortex‑M4, 128 KB flash, UFQFPN‑32) and a tiny eSIM paired with a shielded LTE module. In the second variant, the implant runs on the original battery and fits into the foam‑padding area beneath the OLED display, with the antenna wire running along the top edge. Researchers noted that the implant’s flexible PCB appears to be a professionally manufactured panel, not a hand‑built prototype, and that part numbers on the MCU and eSIM had been scraped off to obscure their identity.
Ledger advises users who purchased a device from CryptoBilis not to set it up if they have not already done so, and to move assets to a new Ledger signer with a fresh seed if setup has been completed. The company reminds consumers to buy only from authorized resellers and to use its Genuine Check tool, while noting that the tool cannot detect added implants when the original Secure Element remains intact. At present, Ledger says there is no evidence that other resellers are distributing compromised wallets, although community trust in the reseller network has been affected.