Ledger confirms hardware implant in wallets sold by reseller CryptoBilis

Ledger has confirmed that some of its hardware wallets distributed through the Southeast Asian reseller CryptoBilis were compromised with a hardware implant that drained users' cryptocurrency wallets. CryptoBilis is described as a major Malaysia-based hardware wallet retailer operating across Southeast Asia.

The timeline runs over a few days. On October 9, Ledger said it had launched an investigation into user reports of cryptocurrency losses and asked CryptoBilis to stop selling and shipping Ledger devices. The next day it confirmed hardware tampering on at least one device, though it is still unclear exactly how or when the devices were tampered with. Ledger said: "Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant." It added that it is reaching out to impacted users and working with authorities to identify the perpetrator. In a later update, Ledger confirmed that all user reports of unexpected fund drains were linked to devices sold through CryptoBilis and described the affected volume as "limited". Ledger did not disclose the type of devices compromised, and has not given a number of victims or an amount stolen.

The technical details come from outside researchers. Some researchers have shown the implant in Ledger X since September 16, saying tampered devices were available for nearly half the price of the original hardware. Mark Karpelès, who leads Karpeles Lab Inc., is CTO at Shells.com and is the former CEO of Mt. Gox, showed a picture of the implant and called it "quite an evolution" from earlier versions that used manually soldered wires. He said the implant was concealed behind the screen, but its antenna cable would have indicated that something was wrong. According to Karpelès, the malicious hardware captured the device's display output and button presses to identify the seed phrase, then sent it to the attacker over an LTE connection using an eSIM. He said his device was not bought through Ledger's recommended channels but from "a well known platform via a Chinese seller (product shipped from Malaysia)". He did not name CryptoBilis as the vendor.

Tibane Labs, a cryptocurrency research and development studio, confirmed Karpelès' finding and said there were two implant versions for Ledger X. Its researchers obtained one device on Amazon Japan from a China-based seller shipped from Malaysia, and the other on Yahoo! Auctions in Japan. In the first variant, the attacker made room for the circuitry by replacing the original battery with a smaller one that powers both the implant and the Ledger X. Under the battery and antenna the researchers found an ST STM32G431KBU6 microcontroller (Arm Cortex-M4, 128 KB flash), plus a tiny eSIM in an 8-pad package just 2×2 mm and a shielded LTE module. In the second variant, which appears to be the one Karpelès described, markings on both the microcontroller and the eSIM had been scraped off to hide part numbers. This version is more advanced: it ran on the original battery and fit into the space normally taken by the foam padding under the OLED display. In both cases the tell-tale was the antenna wire. The researchers also warned that the specimen used "a designed, panelised flex PCB, the kind ordered from a board house, not a hand-built one-off."

Ledger advises users who bought a device from this reseller not to start setup if they have not yet done so, and, if they have set up the device, to consider moving assets to a new Ledger signer with a new seed. It also advises avoiding unauthorized resellers, which carry a higher risk of counterfeit or modified devices, and reminds its authorized resellers and distributors to source products only through authorized channels and not to restock returned products. The company's Genuine Check explicitly warns that it cannot detect added implants when the device's original Secure Element remains intact. There is no indication that other Ledger resellers are shipping compromised wallets, but trust in the reseller network has been damaged, and many are now calling for it to be dismantled.

Key facts

Ledger confirmed that at least one device sold through CryptoBilis, a Malaysia-based reseller, contained an unauthorized hardware implant, and tied all reported fund drains to that reseller.
Ledger investigation began October 9 and it asked CryptoBilis to stop selling and shipping its devices; it describes the affected volume as "limited" and gives no victim count or loss figure.
Researchers Mark Karpelès and Tibane Labs describe spy boards in Ledger X units that read the screen output and button presses to capture the seed phrase and send it over LTE via a 2×2 mm eSIM.
Tibane Labs found two implant versions: one with a smaller replacement battery and an STM32G431KBU6 microcontroller, a more advanced one that fits under the OLED display on the original battery.
Ledger tells buyers from this reseller not to set up the device, or to move funds to a new signer with a new seed if they already did; its Genuine Check cannot detect such implants when the original Secure Element is intact.

Why it matters

A hardware wallet is sold on the promise that the private keys never leave the device, and this case attacks that promise at the supply chain rather than the software. Ledger's own confirmation makes it more than a rumour. The researchers describe a professionally made flex PCB, not a hand-built one-off, which they present as a step up from earlier implants with manually soldered wires. Ledger's Genuine Check, the built-in authenticity test, explicitly cannot detect added implants when the original Secure Element is intact.

Who it affects

Anyone who bought a Ledger device from CryptoBilis, which operates across Southeast Asia, is directly in scope; Ledger links all reported fund drains to devices sold through that reseller. The researchers' two specimens came from marketplace sellers in Japan listing a China-based seller shipping from Malaysia, so gray-market buyers are exposed too. Ledger's authorized resellers and distributors are also affected, as they have been reminded to source only through authorized channels and not to restock returned products. The article says there is no indication that other Ledger resellers are shipping compromised wallets.

How to use it

Ledger's guidance is concrete. If you bought a Ledger device from this reseller and have not set it up, do not start setup. If you have set it up, consider moving assets to a new Ledger signer with a new seed. More broadly, avoid unauthorized resellers, which carry a higher risk of counterfeit or modified devices. Tibane Labs says the tell-tale in both implant versions was the antenna wire, which ran along the top edge in the second one and was taped across the top of the battery and LTE module in the first.

How solid is it

The core fact is solid: Ledger itself confirmed an unauthorized hardware implant in one impacted user's device and linked all reported drains to CryptoBilis. The technical description of how the implant works rests on Karpelès and Tibane Labs, as reported by BleepingComputer, and Tibane Labs said it confirmed his finding. Ledger did not disclose the type of devices compromised; the Ledger X detail comes from researchers and online reports. Karpelès did not name CryptoBilis as the seller of his device.

Risks and caveats

Much is still unknown. It is unclear exactly how or when the devices were tampered with. Ledger calls the affected volume "limited" but the article gives no number of victims or amount stolen, and the perpetrator has not been identified. Ledger says it is working with authorities, with no timescale or authority named. The article also does not say how CryptoBilis responded beyond Ledger's request to stop sales. Because Genuine Check cannot catch such implants, users cannot rely on it alone to rule out tampering.

“Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant.”

— Ledger