TL;DR
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Ledger says all user reports of unexpected cryptocurrency losses under investigation were linked to devices sold by Southeast Asian reseller CryptoBilis. It confirmed an unauthorized hardware implant in at least one affected device, but has not disclosed how many devices were altered or how the tampering happened.
Ledger has confirmed an unauthorized hardware implant in at least one device linked to cryptocurrency theft reports involving wallets sold through CryptoBilis, a Malaysia-based reseller serving Southeast Asia. The company says all user reports of unexpected fund drains it investigated were associated with devices from the reseller, but has not disclosed the number of affected customers or how the devices were tampered with.
Ledger said it began investigating reports of users losing cryptocurrency after purchasing devices through CryptoBilis. On October 9, the company asked the reseller to stop selling and shipping Ledger devices. The following day, Ledger confirmed that one impacted user’s device contained an unauthorized implant and said it was contacting affected users while its investigation continued.
In a later update, Ledger said all reports of unexpected fund drains it had received were linked to devices sold through CryptoBilis. It described the affected volume as “limited,” without publishing a count. The company has not publicly identified the compromised device models. Independent researchers and online reports have examined altered Ledger Nano X devices, but that reporting does not establish that every affected unit was a Nano X.
Ledger urged customers who bought a device from the reseller and have not set it up not to begin setup. For customers who have already set up a device, it advised considering moving assets to a new Ledger signer with a new seed phrase. Ledger also said it was working with authorities to identify the person responsible.
Risks From Altered Wallet Hardware
The reports raise a supply-chain security concern: a hardware wallet is meant to protect the private keys used to control crypto assets, but customers may have difficulty identifying a device that was altered before it reached them. Researchers described implants designed to fit inside the device, making the incident relevant not only to the users who reported losses but also to buyers relying on reseller channels.
Ledger’s guidance is specific to purchases from CryptoBilis; the company has not said that other resellers supplied compromised devices. Still, the incident highlights the limits of ordinary authenticity checks. Ledger says its Genuine Check can verify aspects of a device’s authenticity, but cannot detect an added implant if the original Secure Element remains intact. That means a passing check should not be interpreted as proof that hardware has never been physically modified.
People affected by cryptocurrency theft may not be able to recover their funds, and the source material does not report any recovery. Crypto assets can be volatile, and users face a risk of losing some or all of their holdings. The company’s advice is a security response, not a guarantee that moving assets will reverse losses or prevent every future threat.
As an affiliate, we earn on qualifying purchases.
How Researchers Examined the Devices
Ledger’s investigation followed user reports of losses from wallets bought through CryptoBilis, described in the source report as a major Malaysia-based hardware-wallet retailer operating across Southeast Asia. Researchers had begun sharing findings about altered Ledger X devices in September. The company’s October 9 request for the reseller to halt sales came before its public confirmation of an implant the next day.
Mark Karpelès, who leads Karpeles Lab Inc. and is CTO at Shells.com, published an image of an implant in a Ledger X device. He said it was concealed behind the screen and that an antenna cable could be a sign of tampering. Tibane Labs, a cryptocurrency research and development studio, said it examined two implant variants in devices acquired through separate marketplace listings in Japan; one listing described a China-based seller and shipment from Malaysia.
In its report, Tibane Labs said one variant used a smaller replacement battery to make room for malicious circuitry, including a microcontroller, an eSIM and an LTE module. Researchers said the second variant fit beneath the OLED display and used the original battery. Karpelès and Tibane Labs described ways the hardware could capture screen output and button presses and send information over a cellular connection. These are researchers’ findings about examined samples; Ledger has not publicly confirmed those technical details or identified them as the mechanism behind every reported theft.
““Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant.””
— Ledger
As an affiliate, we earn on qualifying purchases.
Scope and Tampering Method Remain Open
Ledger has not provided a total for compromised devices, affected customers or funds lost. Its description of the affected volume as “limited” is not accompanied by a number or comparison baseline. The company also has not said exactly when or where the devices were altered, who tampered with them, or whether the incident involved only one model.
Researchers’ examinations point to two implant variants in devices they obtained through marketplace listings, but the available information does not establish that those specimens came from CryptoBilis or were directly connected to the reported thefts. The source report says there was no indication at that time that other Ledger resellers were shipping compromised wallets. Whether further cases or affected sellers will be identified remains unknown.
Ledger says its Genuine Check cannot detect an added implant when the original Secure Element remains intact. The company has not described a test that customers can use to rule out that kind of modification, nor has it reported whether authorities have identified a suspect.
As an affiliate, we earn on qualifying purchases.
Customer Guidance and Investigation
Ledger says it is contacting impacted users and working with authorities. Customers who bought through CryptoBilis should follow the company’s device-specific warning: leave an unconfigured device unset up, and consider moving assets from an already configured device to a new signer using a new seed. Customers should consult Ledger’s official support channels for current instructions and avoid entering a seed phrase into a device or website they cannot verify.
The next updates to watch for are Ledger’s findings on the number and models of affected devices, how the implants were introduced, and whether any funds can be traced or recovered. The company has also advised authorized resellers and distributors to source products through authorized channels and not restock returned devices. No timetable for concluding the investigation has been announced.
hardware wallet security accessories
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did Ledger confirm?
Ledger confirmed an unauthorized hardware implant in at least one device connected to user reports of cryptocurrency losses. It said all reports it investigated were linked to devices sold through CryptoBilis.
How many wallets or users were affected?
Ledger has not published a count. It described the affected volume as “limited,” but gave no number or comparison baseline.
What should CryptoBilis customers do?
Ledger advises customers not to set up an unconfigured device bought from the reseller. Those who already set one up should consider moving assets to a new signer with a new seed, following Ledger’s official guidance.
Does Ledger’s Genuine Check detect an implant?
Not necessarily. Ledger says the check cannot detect an added implant if the device’s original Secure Element remains intact.
Has Ledger confirmed that every affected device was a Nano X?
No. Researchers have described implants in Ledger X or Nano X devices, but Ledger has not publicly identified the models involved in all reported cases.
Source: hn
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
