OP 13 October, 2026 - 06:23 AM
Ledger confirmed that some of its devices distributed through Southeast Asian reseller CryptoBilis were compromised by a hardware implant that emptied users' cryptocurrency wallets.
The company was investigating reports of lost funds by users who purchased wallets from CryptoBilis, a major Malaysian hardware wallet retailer operating throughout Southeast Asia.
Several researchers demonstrated the implant in Ledger X devices beginning on September 16 and reported that devices with the swapped components were being sold for nearly half the price of the original hardware.
Ledger wallets are physical devices designed to securely store private keys that control cryptocurrency assets and authorize transactions.
On October 9, Ledger announced it had launched an investigation into user reports of lost cryptocurrency and asked CryptoBilis to stop selling and shipping Ledger devices.
The following day, the company confirmed the hardware tampering with at least one device, although it is unclear how and when the devices were tampered with.
"Ledger confirms that one of the affected users had an unauthorized hardware implant installed on their device. Ledger is contacting affected users as part of the ongoing investigation," Ledger stated.
The crypto wallet maker also noted that it is cooperating with authorities to identify the person responsible and bring them to justice.
"[…] Ledger advises users who purchased a Ledger device from this reseller not to begin setup if they have not already done so. If you have already setup a Ledger device, consider transferring your assets to a new Ledger signer device (with a new seed phrase)," Ledger warned .
Yesterday, Ledger published another update , confirming that all user reports of unexpected charges were related to devices sold through CryptoBilis and describing the number of affected devices as "limited."
The company did not disclose the type of devices compromised in this supply chain attack, but reports have surfaced online of a spy implant in Ledger X devices that blends in with the legitimate hardware.
Mark Karpeles, now head of Karpeles Lab Inc. and CTO of Shells.com, posted a photo of the new implant in the Ledger X, calling it a "significant improvement" over previous versions, which required manual soldering of wires.
Hardware implant inside a Ledger X device
source: Mark Karpeles
The former Mt. Gox CEO reported that the implant was hidden behind the screen, but its antenna cable should have indicated something was amiss.
According to Karpelès, the malicious hardware captured the device's display and keystrokes to determine the seed phrase, then transmitted it to the attacker over an LTE connection using an eSIM.
"Ledger Nano Xs are used to store cryptocurrency. The spy implants are designed to steal any cryptocurrency you store on these Ledger Nano Xs," Karpelès explained .
While the CEO did not identify CryptoBilis as the seller of the compromised Ledger X, he did report that the device was not purchased through Ledger's recommended channels, but "on a reputable platform from a Chinese seller (shipped from Malaysia)."
Tibane Labs, a cryptocurrency research and development studio, confirmed Karpelès's findings and added that there were two versions of the implant for the Ledger X.
Researchers obtained two variants: one in a Ledger device purchased on Amazon Japan from a "seller in China · shipped from Malaysia," and the other purchased on Yahoo! Auctions in Japan.
In a report published over the weekend, Tibane Labs noted that the attacker made room for the malicious circuitry by replacing the original battery with a smaller one that powers both the implant and the Ledger X.
"Under the battery and antenna inside one of the devices, we found an ST STM32G431KBU6 (Arm Cortex-M4, 128 KB flash, UFQFPN-32)."
For communication, the attacker used "a tiny eSIM—a package with 8 contact pads measuring just 2x2 mm, next to the MCU—and a shielded LTE module that sends words out."
In the second hardware wallet examined, Tibane researchers found that the markings on both the MCU (microcontroller unit) and the eSIM had been erased to obscure the component numbers.
The second variant, apparently matching the one described by Karpeles, was more sophisticated. It ran on the original battery and fit in the space typically occupied by the foam padding under the OLED display.
In both cases, the presence of the implant was indicated by the antenna wire, which in the second variant ran along the top edge. In the first variant, the antenna was glued over the battery and shielded LTE module.
Hardware implant inside the Ledger X
source: Tibane Labs
The researchers warned that the sample shown above used an "engineered multi-section flexible printed circuit board (FPC)—one ordered from a circuit board manufacturer, rather than handcrafted in a single copy."
Ledger advises users to avoid purchasing from unauthorized resellers, as they increase the risk of receiving counterfeit or modified devices.
The company also reminds authorized resellers and distributors that products should only be purchased through authorized channels and that they should not return items that have already been returned by customers.
Ledger provides a "Genuine Check" mechanism to verify device authenticity; however, the company explicitly warns that it cannot detect implanted devices if the device's original Secure Element remains intact.
There are currently no indications that other Ledger resellers are supplying compromised wallets. However, community trust in the reseller network has been undermined, with many now calling for its closure.
source : https://www.bleepingcomputer.com/...ware...to-thefts/
The company was investigating reports of lost funds by users who purchased wallets from CryptoBilis, a major Malaysian hardware wallet retailer operating throughout Southeast Asia.
Several researchers demonstrated the implant in Ledger X devices beginning on September 16 and reported that devices with the swapped components were being sold for nearly half the price of the original hardware.
Ledger wallets are physical devices designed to securely store private keys that control cryptocurrency assets and authorize transactions.
On October 9, Ledger announced it had launched an investigation into user reports of lost cryptocurrency and asked CryptoBilis to stop selling and shipping Ledger devices.
The following day, the company confirmed the hardware tampering with at least one device, although it is unclear how and when the devices were tampered with.
"Ledger confirms that one of the affected users had an unauthorized hardware implant installed on their device. Ledger is contacting affected users as part of the ongoing investigation," Ledger stated.
The crypto wallet maker also noted that it is cooperating with authorities to identify the person responsible and bring them to justice.
"[…] Ledger advises users who purchased a Ledger device from this reseller not to begin setup if they have not already done so. If you have already setup a Ledger device, consider transferring your assets to a new Ledger signer device (with a new seed phrase)," Ledger warned .
Yesterday, Ledger published another update , confirming that all user reports of unexpected charges were related to devices sold through CryptoBilis and describing the number of affected devices as "limited."
The company did not disclose the type of devices compromised in this supply chain attack, but reports have surfaced online of a spy implant in Ledger X devices that blends in with the legitimate hardware.
Mark Karpeles, now head of Karpeles Lab Inc. and CTO of Shells.com, posted a photo of the new implant in the Ledger X, calling it a "significant improvement" over previous versions, which required manual soldering of wires.
Hardware implant inside a Ledger X device
source: Mark Karpeles
The former Mt. Gox CEO reported that the implant was hidden behind the screen, but its antenna cable should have indicated something was amiss.
According to Karpelès, the malicious hardware captured the device's display and keystrokes to determine the seed phrase, then transmitted it to the attacker over an LTE connection using an eSIM.
"Ledger Nano Xs are used to store cryptocurrency. The spy implants are designed to steal any cryptocurrency you store on these Ledger Nano Xs," Karpelès explained .
While the CEO did not identify CryptoBilis as the seller of the compromised Ledger X, he did report that the device was not purchased through Ledger's recommended channels, but "on a reputable platform from a Chinese seller (shipped from Malaysia)."
Tibane Labs, a cryptocurrency research and development studio, confirmed Karpelès's findings and added that there were two versions of the implant for the Ledger X.
Researchers obtained two variants: one in a Ledger device purchased on Amazon Japan from a "seller in China · shipped from Malaysia," and the other purchased on Yahoo! Auctions in Japan.
In a report published over the weekend, Tibane Labs noted that the attacker made room for the malicious circuitry by replacing the original battery with a smaller one that powers both the implant and the Ledger X.
"Under the battery and antenna inside one of the devices, we found an ST STM32G431KBU6 (Arm Cortex-M4, 128 KB flash, UFQFPN-32)."
For communication, the attacker used "a tiny eSIM—a package with 8 contact pads measuring just 2x2 mm, next to the MCU—and a shielded LTE module that sends words out."
In the second hardware wallet examined, Tibane researchers found that the markings on both the MCU (microcontroller unit) and the eSIM had been erased to obscure the component numbers.
The second variant, apparently matching the one described by Karpeles, was more sophisticated. It ran on the original battery and fit in the space typically occupied by the foam padding under the OLED display.
In both cases, the presence of the implant was indicated by the antenna wire, which in the second variant ran along the top edge. In the first variant, the antenna was glued over the battery and shielded LTE module.
Hardware implant inside the Ledger X
source: Tibane Labs
The researchers warned that the sample shown above used an "engineered multi-section flexible printed circuit board (FPC)—one ordered from a circuit board manufacturer, rather than handcrafted in a single copy."
Ledger advises users to avoid purchasing from unauthorized resellers, as they increase the risk of receiving counterfeit or modified devices.
The company also reminds authorized resellers and distributors that products should only be purchased through authorized channels and that they should not return items that have already been returned by customers.
Ledger provides a "Genuine Check" mechanism to verify device authenticity; however, the company explicitly warns that it cannot detect implanted devices if the device's original Secure Element remains intact.
There are currently no indications that other Ledger resellers are supplying compromised wallets. However, community trust in the reseller network has been undermined, with many now calling for its closure.
source : https://www.bleepingcomputer.com/...ware...to-thefts/
![[Image: Pn2slWO.jpeg]](https://i.imgur.com/Pn2slWO.jpeg)
LIFETIME