TL;DR
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Ledger says all user reports of unexpected cryptocurrency losses in its investigation involved devices sold through Southeast Asian reseller CryptoBilis, and it confirmed an unauthorized hardware implant in at least one device. Researchers have described implants that may capture screen output and button presses, but Ledger has not publicly confirmed the devices’ model or how the tampering occurred.
Ledger says all user reports of unexpected cryptocurrency losses in its investigation involved devices sold through Southeast Asian reseller CryptoBilis, and the company has confirmed an unauthorized hardware implant in at least one device. The finding raises concerns about the security of hardware wallets bought through resellers, though the company has not disclosed how or when the affected devices were altered.
Ledger said it opened an investigation on October 9 after users reported losing funds from wallets purchased through CryptoBilis, a Malaysia-based retailer operating across Southeast Asia. It asked the reseller to stop selling and shipping Ledger devices. The next day, Ledger said one affected user’s device contained an unauthorized implant and that it was contacting users as its investigation continued.
In a subsequent update, Ledger said all reports of unexpected fund drains it had received in the case were linked to devices sold through CryptoBilis. The company described the affected volume as “limited” but did not publish a number. Ledger has not identified the compromised model or explained when and where the devices were modified. It said it was working with authorities to identify the perpetrator.
Independent researchers have reported finding spy hardware in Ledger Nano X devices. Mark Karpelès, who shared an image of an implant, said it could capture screen output and button presses to identify a recovery seed phrase, then send information using an LTE connection and an eSIM. Tibane Labs reported examining two implant versions and described circuitry, a cellular module and antenna components. Those technical accounts are researchers’ findings; Ledger has not publicly confirmed that specific design or mechanism.
The Risk of Reseller Wallets
A hardware wallet is designed to keep the private keys used to control cryptocurrency assets on a physical device. A malicious implant could undermine that protection if it captures information that gives an attacker access to a wallet. Researchers say the devices they examined could collect a recovery seed, a phrase that can restore wallet access. Ledger’s public statements establish that an implant was found in at least one device, but do not verify every detail researchers have attributed to it.
The case also highlights a supply-chain risk: a device can be altered before it reaches a buyer. Ledger advises customers to buy through authorized channels and warns that its Genuine Check cannot detect added hardware when the original Secure Element remains intact. That limitation matters because a passing authenticity check should not be treated as proof that a device contains no extra circuitry.
Crypto assets can be lost permanently when someone else gains control of a wallet, and their prices can fluctuate sharply. This report does not recommend buying or selling any asset. The company has not said how many users or how much cryptocurrency may have been affected.
hardware wallet security accessories
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
How the Investigation Developed
On October 9, Ledger said it was investigating user reports and asked CryptoBilis to halt sales and shipments. On October 10, it disclosed that one affected user’s device contained an unauthorized hardware implant. The company later said that all user reports of unexpected fund drains in its investigation were linked to devices sold through that reseller, while characterizing the affected volume as limited.
Researchers’ accounts provide additional technical context, but do not fill every gap in Ledger’s public account. Karpelès described an implant concealed behind the display, with an antenna cable he said could reveal tampering. Tibane Labs reported two variants: one that used a smaller replacement battery and another fitted beneath the display. The researchers said both designs had antenna wires. Their findings concern devices they examined; they do not establish how many altered devices were distributed or whether every report involved the same design.
““One of the impacted users’ devices contained an unauthorized hardware implant.””
— Ledger
As an affiliate, we earn on qualifying purchases.
What the Public Record Leaves Open
The number of affected devices and users has not been disclosed, and Ledger’s description of the volume as “limited” is not accompanied by a figure or a defined comparison. The company has not said when or where the devices were tampered with, which models were involved, or how the units reached customers.
Researchers have described specific implant components and a possible method for capturing recovery phrases, but Ledger has not publicly verified those details. The evidence presented by researchers does not establish that every device sold through CryptoBilis was altered. Ledger has said there is no indication that other resellers shipped compromised wallets; the scope of the investigation and its findings could change as more information emerges.
As an affiliate, we earn on qualifying purchases.
Advice and Investigation Ahead
Ledger says it is contacting affected users and working with authorities to identify the perpetrator. Customers who bought a Ledger device through CryptoBilis should follow the company’s published guidance: do not begin setup if the device has not been set up, and consider moving assets to a new Ledger signer with a new seed if setup has already occurred. Users should consult Ledger’s direct instructions for their situation.
The next key information will be whether Ledger or authorities publish a clearer count, identify the affected models, or explain how the implants entered the reseller supply chain. Ledger has also advised authorized distributors to obtain products through authorized channels and not restock returned devices. No timetable for further findings has been announced.
hardware wallet with anti-spy features
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did Ledger confirm?
Ledger said at least one device belonging to an affected user contained an unauthorized hardware implant. It later said all user reports of unexpected fund drains in its investigation involved devices sold through CryptoBilis.
Which Ledger devices were affected?
Ledger has not publicly identified the affected model. Researchers have described implants found in Ledger Nano X devices, but the company has not confirmed that model in its public account.
What should CryptoBilis customers do?
Ledger advises customers who have not set up a device bought from the reseller not to begin setup. Those who have set one up should consider moving assets to a new Ledger signer using a new seed and consult Ledger’s guidance.
Can Ledger’s Genuine Check detect an implant?
Ledger warns that Genuine Check cannot detect added hardware when the device’s original Secure Element remains intact. The check should not be understood as proof that no extra circuitry is present.
How many people or devices were affected?
Ledger has not disclosed a count. It described the affected volume as “limited,” but has not specified a number or explained the basis for that description.
Source: hn
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
