Ledger has confirmed that some of its devices sold through CryptoBilis, a major Malaysia-based hardware wallet retailer, were compromised with unauthorized hardware implants designed to steal cryptocurrency.
The company launched an investigation in October after receiving reports from users who lost funds from wallets purchased through CryptoBilis. On October 10, Ledger confirmed hardware tampering on at least one device, stating: “Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant.”
According to analysis by Mark Karpelès, CTO at Shells.com, the malicious implant in Ledger X devices was concealed behind the screen and functioned by capturing the device’s display output and button presses to identify the seed phrase, then transmitting it to attackers over an LTE connection using an eSIM. The implant required replacing the original battery with a smaller one to fit the additional circuitry.
Tibane Labs, a cryptocurrency research studio, confirmed these findings and identified two implant variants. Researchers obtained specimens purchased from Amazon Japan and Yahoo! Auctions Japan, both shipped from Malaysia. In one variant, the malicious components—an ST STM32G431KBU6 microcontroller and a 2×2 mm eSIM—sat under the battery alongside a shielded LTE module. The second, more advanced variant fit into the space normally occupied by foam padding under the OLED display and ran on the original battery.
Both implants were detectable by antenna wires, though Tibane Labs noted the specimens used “a designed, panelised flex PCB, the kind ordered from a board house,” suggesting a sophisticated, mass-produced attack rather than individual tampering.
Ledger advised users who purchased devices from CryptoBilis not to initiate setup if they have not done so, and to move assets to a new Ledger signer with a fresh seed if they have already set up their device. The company confirmed that all reported fund drains linked to CryptoBilis purchases and described the affected volume as “limited.”
Ledger noted it was working with authorities to identify the perpetrators. The company also stated its ‘Genuine Check’ mechanism cannot detect added implants when the device’s original Secure Element remains intact, and recommended avoiding unauthorized resellers.
Key facts
- Ledger confirmed unauthorized hardware implants in devices sold through CryptoBilis, a Malaysia-based reseller
- The implant captured display output and button presses to steal seed phrases and transmitted data via LTE/eSIM
- Researchers identified two implant variants in Ledger X devices, with the advanced version fitting under the OLED display foam
- Affected devices were purchased through third-party platforms including Amazon Japan and Yahoo! Auctions Japan
- Ledger’s ‘Genuine Check’ authenticity tool cannot detect added hardware implants