Key points
- Ledger confirmed unauthorized hardware implants in devices sold by CryptoBilis, a Malaysia-based reseller.
- The company advised users who bought from this retailer to avoid setup or migrate assets to new signers.
- Researcher Mark Karpelès described the implant as an evolution of previous tampering methods, hidden behind the screen.
The short version
- Ledger has verified that some hardware wallets distributed by CryptoBilis contained malicious implants.
- All reported fund drains are linked to devices purchased through this specific Southeast Asian retailer.
- The vendor describes the affected volume as limited but is working with authorities on the investigation.
The details
Ledger confirmed on 9 October that it launched an investigation into reports of cryptocurrency losses linked to devices sold by CryptoBilis. The firm asked the Malaysia-based retailer to stop selling and shipping its hardware immediately. By the following day, Ledger verified that at least one device contained an unauthorised hardware implant. The company stated it is contacting impacted users directly as part of this ongoing probe.
The vendor noted that all user reports of unexpected fund drains were connected to devices purchased through CryptoBilis. Ledger described the total volume of affected devices as limited. While the company did not specify which models were compromised in its initial statements, online reports focus on the Ledger X. Researchers have indicated that tampered units were available for nearly half the price of legitimate hardware since 16 September.
The context
Hardware wallets are physical devices designed to store private keys securely, keeping cryptocurrency assets offline and authorising transactions safely. The current incident represents a supply-chain compromise where the threat occurred before the device reached the end user. Mark Karpelès, former CEO of Mt. Gox and current CTO at Shells.com, analysed images of the new implant found in Ledger X devices. He described the hardware as a significant evolution from previous tampering attempts, which relied on manually soldered wires.
Karpelès noted that the new spy implant is concealed behind the device screen, making it difficult to detect visually. However, he pointed out that the antenna cable associated with the implant would typically indicate that something was wrong. Ledger stated it is collaborating with authorities to identify the perpetrator responsible for the tampering and bring them to justice.
Defender's checklist
Security teams should verify the provenance of all hardware security keys and cold storage devices. Purchasing from authorised distributors reduces the risk of supply-chain tampering. Users should inspect devices for physical anomalies, such as unusual cables or signs of disassembly, before initial setup. If a device is suspected of being compromised, it should not be connected to any network or used to sign transactions.
What to do and how to stay safe: Ledger
- Do not initialise or set up any Ledger device purchased from CryptoBilis until further notice.
- If you have already set up a device from this reseller, move your assets to a new Ledger signer with a fresh seed phrase immediately.
- Verify that your hardware wallet was purchased directly from Ledger or an authorised distributor listed on their official website.
- Monitor your cryptocurrency accounts for unauthorised transactions or unexpected balance changes following the use of potentially compromised devices.
Step-by-step guide: Phishing vs Spear Phishing: Targeting Mechanics and Defence
General security guidance from the Cipher Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific Ledger devices are affected by this implant?
While Ledger did not explicitly name the models in its official update, online reports and researcher analysis focus on the Ledger X device.
How can I tell if my hardware wallet has been tampered with?
Researchers note that the implant is hidden behind the screen, but the presence of an antenna cable may indicate that the device has been modified.
Is Ledger providing a software fix for this issue?
No software fix exists for hardware implants; the vendor recommends moving assets to a new device with a new seed if you purchased from the implicated reseller.
