Ledger Confirms Hardware Implant in Devices Tied to $93M CryptoBilis Theft

Update 03:07 UTC: The Europe claims took a further step on October 12, when Johannes said he bought a second Nano X at a different MediaMarkt location, filmed a 2 minute 31 second unboxing and found modifications identical to his first unit, including extra cables, an LTE module and an antenna, in packaging printed…

Implant Confirmed Inside Customer Devices

Ledger confirmed on October 11 that at least one hardware wallet belonging to an affected user contained an “unauthorized hardware implant,” the company’s first official acknowledgment of physical tampering in the Southeast Asia theft case. In its support statement, the company said the finding emerged while it investigated devices purchased through CryptoBilis, an authorized retail partner for Malaysia, Indonesia and the Philippines. Ledger stressed there is no evidence its own infrastructure, systems or services were breached, framing the incident as a supply-chain or physical device compromise rather than a remote hack of its servers, firmware or Secure Element chip. A teardown by security researchers at Tibane Labs explains the mechanism: instead of attacking the Secure Element, the attackers added a tiny circuit board that taps the data lines running between the chip and the OLED display. When a user initializes a new device, Ledger shows the 24-word recovery phrase on screen, and the implant reads the pixel data sent to the display, recognizes the words, and relays them through its own LTE module, SIM card and antenna. With the phrase in hand, an attacker can rebuild the wallet and the private key it protects on a separate device without touching the victim’s unit again. Because the implant leaves the Secure Element and firmware untouched, Ledger’s Genuine Check can still report the device as authentic, a different failure mode from a forged clone or a software fork of the code. Tibane Labs has documented at least three generations of the implant, from hand-soldered prototypes that required shrinking the original battery to custom flex PCBs matched to factory test points, fitted with cellular chips, eSIM and paint-matched components whose markings were ground off, work the researchers say points to a funded operation rather than a lone hobbyist.

A new weighing-based check is circulating among owners after former Mt. Gox CEO Mark Karpelès opened a sealed Nano X bought in Malaysia and found the spy setup firsthand. His unit used a shorter battery to make room for the board behind the screen, and he put the remaining weight gap at roughly one gram, which he said falls within normal factory variance since batteries of equal capacity can differ in mass. That margin sits below the resolution of a kitchen scale reading in one-gram steps, so a clean reading proves little either way; precision micro scales help only when calibrated against a reference weight, and opening the casing stays the only direct way to inspect the board. Karpelès noted the difference "varies by ~1g" due to factory variables, in a post on X dated October 11.

In a 72-hour update posted Sunday, Ledger said the volume of impacted devices is "limited," that it is working with relevant authorities and reaching out to affected users, and that it is reminding authorized resellers and distributors to source products only through official channels and never to restock returned products. The company also warned that scammers may exploit the incident, saying it will never call, DM or ask for a 24-word recovery phrase. Separately, an X user named Johannes claimed to have found two tampered devices bought from retail stores in Europe, both with identical modifications including additional cables and an LTE module, and called for a product recall. He is sending the second unit to Ledger for analysis, and the claims remain unverified, with Ledger's update stating all confirmed cases so far involve CryptoBilis devices.

The scare widened beyond Southeast Asia over the weekend as new tampering claims surfaced in Europe. X user Johannes, who had already flagged two modified devices bought from European stores, said he later unboxed a unit purchased directly from Ledger's official German reseller MediaMarkt and found an implant with extra cables that he described as an older version of the spy hardware, adding that no funds had been drained from it so far. Another user shared the inside of a wallet bought from Philippine reseller LazMall, which Karpelès identified as carrying a "manual coil antenna" style implant, and a tampered Ledger Stax bought from CryptoBilis surfaced separately. Attention also turned to CryptoBilis itself: former CEO Arravind Prabu said on X that the firm was acquired earlier this year and that he has stepped down from all operations.

The Europe claims took a further step on October 12, when Johannes said he bought a second Nano X at a different MediaMarkt location, filmed a 2 minute 31 second unboxing and found modifications identical to his first unit, including extra cables, an LTE module and an antenna, in packaging printed in German. A store clerk told him the unit was not a customer return, saying returned Ledgers go back to the manufacturer, and records shown on the store computer point to Aqipa GmbH, an Austrian consumer electronics distributor, as the source. Johannes also posted a private message in which Ledger CTO Charles Guillemet said the extra cables should not be present on a genuine device, though the screenshot is one-sided and unconfirmed. The first device is headed to Karpelès, and Ledger has so far verified no cases outside CryptoBilis.

@Ledger_Support · X post

In its support statement.

View on X

Bitquery Lifts Estimate to $93.2 Million

On-chain analytics firm Bitquery re-tracked the addresses linked to the case and now estimates the suspected haul at roughly $93.2 million, spread across 315 wallets on six blockchains including Bitcoin, Ethereum, Tron, BNB Chain and Polygon, with Tron assets making up the largest share. That figure is third-party on-chain attribution: Ledger has not confirmed either the 315-wallet count or the total. Bitquery’s tracing shows stolen assets moving through Tornado Cash, Zcash and other exchange channels, with 1,736 ETH pushed into those flows in the latest update, and about $5.35 million of USDC sitting in addresses that Circle could still freeze. Tether has already acted, freezing around $10 million of USDT at addresses tied to the suspected theft, a lever holders of native BTC and ETH do not have once funds move. Under pressure from the widening numbers, CryptoBilis has gone beyond the initial suspension of Ledger products and stopped selling its entire hardware wallet inventory until the investigation clarifies, working with law enforcement and Ledger’s security team on a full review of the distribution route. The reseller matters because it was not an anonymous online seller but a formal sales channel, which concentrates the investigation on one retail pipeline instead of Ledger’s global product line. Ledger says every confirmed asset-drain case so far involves devices sold through CryptoBilis, and that no similar problems have surfaced in its own direct sales channel. For customers who bought from the reseller in recent months, the guidance is blunt: do not initialize a device that is still sealed, and if funds already sit on one, move them to a trusted new device with a completely new recovery phrase, since a phrase once displayed on a compromised screen must be presumed leaked.

Direct Channels Show No Losses

Our reading is that this case rewires two assumptions at once. First, an air-gapped hardware wallet is only as trustworthy as its distribution path: the compromise happened between the factory and the customer, at a named authorized reseller, so buying from a local dealer stops being a safer default than manufacturer-direct shipping with seal checks. Second, recovery options split along asset lines, since Tether and Circle could freeze over $15 million combined while moved BTC and ETH are effectively gone, a structural difference between centralized stablecoins and native assets. Rumors that Ledger’s servers were breached lack supporting evidence so far, so treating the episode as company-wide FUD would overshoot; the confirmed failure is one reseller pipeline, and the practical takeaway is to order directly, inspect seals, and rotate the recovery phrase if there is any doubt.