Ledger has confirmed that an unauthorized Ledger hardware implant was present in a device linked to reported cryptocurrency thefts. The investigation centers on wallets sold through CryptoBilis, a Malaysia-based reseller operating across Southeast Asia.
According to Ledger, all unexpected fund-drain reports received during its investigation involved devices from that reseller. The company described the affected volume as limited but has not disclosed an exact number.
Ledger Asks CryptoBilis to Suspend Sales
Ledger announced its investigation on October 9 after customers reported losing cryptocurrency from wallets purchased through CryptoBilis. It also asked the retailer to stop selling and shipping its devices.
The following day, Ledger confirmed physical tampering in at least one affected wallet. However, investigators have not established when or where someone modified the hardware.
The company said it was contacting affected customers and working with authorities to identify those responsible.
Meanwhile, Ledger advised customers who have not yet configured devices from CryptoBilis to leave them uninitialized. For those already using one, it recommended considering a transfer to a new Ledger device with a newly generated seed phrase.
Ledger Hardware Implant Captures Recovery Information
Separate research into modified Ledger Nano X wallets describes implants that intercept display output and button presses.
According to the findings, this allows the malicious circuitry to capture the wallet’s seed phrase. That recovery information can give an attacker control over the associated cryptocurrency assets.
The implant then reportedly transmits the captured information through an LTE connection using an embedded SIM.
Although Ledger confirmed an unauthorized implant, it did not identify the affected models in its public updates. The detailed Nano X findings come from independent hardware examinations.
Researchers Discover Two Implant Designs
Researchers examined two modified Nano X devices purchased through Japanese online marketplaces. One came from a China-based seller shipping from Malaysia, while the other came from an auction listing.
The first design replaced the original battery with a smaller unit, creating space for additional circuitry. The replacement battery powered both the wallet and the implant.
The added components included a microcontroller, a tiny eSIM and a shielded LTE module. An antenna ran across the battery and communications hardware.
By contrast, the second design retained the original battery. Its circuitry occupied space normally filled by foam padding beneath the OLED display.
Researchers also found that someone had removed component markings, making the parts harder to identify. Nevertheless, an antenna wire along the casing remained a visible sign of modification.
The findings included a professionally manufactured flexible circuit board, suggesting a more developed design than a simple hand-wired modification.
Genuine Check Cannot Detect Every Modification
Ledger’s device authentication feature has an important limitation in this scenario.
The company warns that its Genuine Check cannot detect added hardware implants when the original Secure Element remains intact. Consequently, a modified device could retain authentic security components while carrying separate circuitry that intercepts sensitive information.
This distinction matters because confirming the original hardware’s authenticity does not necessarily establish that nobody added components afterward.
Company Warns Against Unverified Supply Channels
Ledger urged customers to avoid unauthorized sellers because of the increased risk of counterfeit or modified devices.
It also reminded distributors and authorized resellers to obtain stock through approved channels and avoid putting returned products back into circulation.
At the time of the updates, Ledger had not identified other resellers shipping compromised wallets. Meanwhile, the relationship between the independently examined marketplace devices and the CryptoBilis investigation remains unconfirmed.
0 responses to “Ledger Hardware Implant Linked to Crypto Wallet Thefts”