Ledger Confirms Hardware Implant in Devices Tied to $93M CryptoBilis Theft

Implant Confirmed Inside Customer Devices

Ledger confirmed on October 11 that at least one hardware wallet belonging to an affected user contained an “unauthorized hardware implant,” the company’s first official acknowledgment of physical tampering in the Southeast Asia theft case. In its support statement, the company said the finding emerged while it investigated devices purchased through CryptoBilis, an authorized retail partner for Malaysia, Indonesia and the Philippines. Ledger stressed there is no evidence its own infrastructure, systems or services were breached, framing the incident as a supply-chain or physical device compromise rather than a remote hack of its servers, firmware or Secure Element chip. A teardown by security researchers at Tibane Labs explains the mechanism: instead of attacking the Secure Element, the attackers added a tiny circuit board that taps the data lines running between the chip and the OLED display. When a user initializes a new device, Ledger shows the 24-word recovery phrase on screen, and the implant reads the pixel data sent to the display, recognizes the words, and relays them through its own LTE module, SIM card and antenna. With the phrase in hand, an attacker can rebuild the wallet and the private key it protects on a separate device without touching the victim’s unit again. Because the implant leaves the Secure Element and firmware untouched, Ledger’s Genuine Check can still report the device as authentic, a different failure mode from a forged clone or a software fork of the code. Tibane Labs has documented at least three generations of the implant, from hand-soldered prototypes that required shrinking the original battery to custom flex PCBs matched to factory test points, fitted with cellular chips, eSIM and paint-matched components whose markings were ground off, work the researchers say points to a funded operation rather than a lone hobbyist.

@Ledger_Support · X post

In its support statement.

View on X

Bitquery Lifts Estimate to $93.2 Million

On-chain analytics firm Bitquery re-tracked the addresses linked to the case and now estimates the suspected haul at roughly $93.2 million, spread across 315 wallets on six blockchains including Bitcoin, Ethereum, Tron, BNB Chain and Polygon, with Tron assets making up the largest share. That figure is third-party on-chain attribution: Ledger has not confirmed either the 315-wallet count or the total. Bitquery’s tracing shows stolen assets moving through Tornado Cash, Zcash and other exchange channels, with 1,736 ETH pushed into those flows in the latest update, and about $5.35 million of USDC sitting in addresses that Circle could still freeze. Tether has already acted, freezing around $10 million of USDT at addresses tied to the suspected theft, a lever holders of native BTC and ETH do not have once funds move. Under pressure from the widening numbers, CryptoBilis has gone beyond the initial suspension of Ledger products and stopped selling its entire hardware wallet inventory until the investigation clarifies, working with law enforcement and Ledger’s security team on a full review of the distribution route. The reseller matters because it was not an anonymous online seller but a formal sales channel, which concentrates the investigation on one retail pipeline instead of Ledger’s global product line. Ledger says every confirmed asset-drain case so far involves devices sold through CryptoBilis, and that no similar problems have surfaced in its own direct sales channel. For customers who bought from the reseller in recent months, the guidance is blunt: do not initialize a device that is still sealed, and if funds already sit on one, move them to a trusted new device with a completely new recovery phrase, since a phrase once displayed on a compromised screen must be presumed leaked.

Direct Channels Show No Losses

Our reading is that this case rewires two assumptions at once. First, an air-gapped hardware wallet is only as trustworthy as its distribution path: the compromise happened between the factory and the customer, at a named authorized reseller, so buying from a local dealer stops being a safer default than manufacturer-direct shipping with seal checks. Second, recovery options split along asset lines, since Tether and Circle could freeze over $15 million combined while moved BTC and ETH are effectively gone, a structural difference between centralized stablecoins and native assets. Rumors that Ledger’s servers were breached lack supporting evidence so far, so treating the episode as company-wide FUD would overshoot; the confirmed failure is one reseller pipeline, and the practical takeaway is to order directly, inspect seals, and rotate the recovery phrase if there is any doubt.