TL;DR
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Ledger says all user reports of unexpected fund losses it investigated were linked to devices sold through Malaysia-based reseller CryptoBilis. Researchers have described concealed hardware implants in Ledger Nano X devices, but Ledger has not publicly confirmed the models or how the devices were altered.
Ledger has linked reports of cryptocurrency theft to hardware wallets sold through Southeast Asian reseller CryptoBilis, confirming that at least one affected device contained an unauthorized implant. The company says all reports of unexpected fund losses it investigated involved devices sold through the reseller, while researchers have described concealed implants in Ledger Nano X devices; Ledger has not publicly specified which models were compromised.
Ledger said it began investigating after users reported losing funds from wallets purchased through CryptoBilis, a Malaysia-based retailer operating across Southeast Asia. On October 9, the company asked the reseller to stop selling and shipping Ledger devices. The next day it confirmed hardware tampering on at least one device and said it was contacting affected users as the investigation continued.
In a later update, Ledger said all user reports of unexpected fund drains it had received were associated with devices sold through CryptoBilis, describing the affected volume as “limited.” The company has not released a count of users or devices, nor publicly identified the models. It said it was working with authorities to identify the person responsible.
Independent researchers have reported finding two implant variants in devices identified as Ledger Nano X. Mark Karpelès, who leads Karpeles Lab Inc. and is CTO at Shells.com, shared an image of an implant concealed behind a device screen. Tibane Labs, a cryptocurrency research and development studio, said it examined two variants. Those findings provide technical detail about examined specimens but do not establish how many devices were altered or who altered them.
Why Tampered Wallets Put Funds at Risk
Hardware wallets are designed to keep the private keys used to control cryptocurrency away from internet-connected computers. If an implant can capture information entered or displayed during setup, it could undermine that protection and allow an attacker to access assets. That is the mechanism researchers describe, not a full public account from Ledger of how the confirmed device was used.
The case also shows a practical limit of authenticity checks. Ledger offers a Genuine Check feature, but the company warns that it cannot detect an added implant if the device’s original Secure Element remains intact. Buyers therefore cannot treat a successful check as proof that every component is unmodified. Cryptocurrency theft can result in irreversible losses; the incident does not establish that other resellers’ stock is affected.
hardware crypto wallet with tamper-proof security
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
How the Reseller Investigation Developed
Ledger wallets are physical devices used to store private keys and authorize cryptocurrency transactions. The company’s response began after reports from people who had bought devices through CryptoBilis. Its October 9 request to halt sales and shipments was followed the next day by confirmation that at least one device contained unauthorized hardware.
Researchers’ accounts describe different approaches to fitting the circuitry. Tibane Labs said one specimen used a smaller replacement battery to make room for components, including a microcontroller and an eSIM-linked LTE module. In another, researchers reported that the implant occupied space beneath the display. They identified an antenna wire as a visible clue in both examples. These are researchers’ findings from devices they examined; the source does not establish that every device sold by CryptoBilis contained an implant.
Ledger advises buying through authorized channels and tells authorized distributors not to restock returned products. It has also warned customers who bought from CryptoBilis not to begin setting up an unused device. Those who already set one up were advised to consider moving assets to a new Ledger signer with a new seed.
““One of the impacted users’ devices contained an unauthorized hardware implant.””
— Ledger
As an affiliate, we earn on qualifying purchases.
Scope and Implant Method Remain Unclear
Ledger has not said how many devices or users were affected, when or where the hardware was altered, or who was responsible. Its public confirmation covers an implant in at least one device and reports linked to CryptoBilis; it has not publicly confirmed that all the researcher-described Nano X specimens came from the reseller.
The researchers’ accounts explain how the implants they examined may have captured information and sent it over a cellular connection. Ledger has not released a technical account confirming that this was the method behind every reported theft. The company says the affected volume was “limited,” but has not given a number or a comparison basis. There is no indication in the source material that other Ledger resellers shipped compromised devices; that does not rule out further findings.
cryptocurrency hardware wallet accessories
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Ledger says it is reaching out to affected users and working with authorities to identify the person responsible. It has not announced a completion date for the investigation or said when it will publish further technical findings. Customers who bought through CryptoBilis should follow Ledger’s guidance: leave an unused device unconfigured, and consider moving assets from a device already set up to a new signer with a new seed.
Ledger also advises customers to use authorized sellers and says authorized distributors should source products through approved channels and avoid restocking returned devices. Further updates would be needed to clarify the number of affected wallets, the relationship between the researched specimens and the theft reports, and whether investigators have identified a suspect.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did Ledger confirm?
Ledger confirmed that at least one device linked to the investigation contained an unauthorized hardware implant. It said all user reports of unexpected fund drains it investigated involved devices sold through CryptoBilis.
Were all Ledger wallets or all CryptoBilis devices affected?
The source does not say that. Ledger described the affected volume as “limited” but did not provide a count, and it has not said that every device sold by CryptoBilis was tampered with. There is no indication in the report that other resellers shipped compromised devices.
What should a CryptoBilis customer do?
Ledger advised customers who have not set up a device from the reseller not to begin setup. For a device already set up, Ledger said to consider moving assets to a new Ledger signer with a new seed. Customers should consult Ledger’s current guidance directly.
Can Ledger’s Genuine Check detect an implant?
Not necessarily. Ledger warns that its Genuine Check cannot detect added implants if the original Secure Element remains intact, so a successful check does not rule out every form of hardware tampering.
Has anyone been identified as responsible?
Not in the information provided. Ledger said it is working with authorities to identify the perpetrator, but has not announced a suspect or explained how or when the devices were altered.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
