Ledger Confirms Hidden Implant in a Device Sold by CryptoBilis

Ledger has confirmed that at least one device tied to recent user losses contained an unauthorized hardware implant. In plain terms, the hardware had been physically altered somewhere between the factory and the buyer. Every confirmed case so far involves products distributed by CryptoBilis, a reseller that operates in Indonesia, Malaysia and the Philippines.

In an Oct. 10 statement, Ledger Support said one impacted user's device contained an unauthorized hardware implant.

Ledger can confirm that one of the impacted users' devices contained an unauthorized hardware implant.

A day later, on Oct. 11, the company said all confirmed cases relate to the disclosed draining incident of Oct. 9, 2026, and involve devices sold through CryptoBilis. Ledger says its internal systems and direct sales channels were not affected, and that the physical tampering is isolated to the batch the reseller distributed. The confirmation is the first concrete evidence behind earlier speculation of supply-chain tampering.

The Check That Watches the Chip, Not the Case

One detail in Ledger's own security documentation explains why this is awkward for owners. Genuine Check verifies the secure element's authenticity, the chip that generates and stores your keys. It cannot detect unauthorized physical modification, such as a spying implant, if that element remains intact.

The check guards the component, not the board around it. An attacker who leaves the secure element alone and adds hardware beside it stays outside the part of the product doing the verifying.

What Researchers Found Inside Modified Devices

Tibane Labs, which has been examining suspicious Ledger Nano X devices with former Mt. Gox chief executive Mark Karpelès, documented three generations of implants designed to intercept recovery phrases. According to its research, the implants work by monitoring electronic signals sent between the wallet's secure element and its display.

The modified devices contained extra microcontrollers that could read the screen's data, rebuild the recovery words and transmit them through cellular modems with SIM components. A more advanced version examined in September held a custom circuit board hidden under the screen, with an LTE modem, an antenna, and components whose identifying markings had been removed.

One limit matters here: Tibane's two specimens were bought through Japanese marketplaces rather than from CryptoBilis, and its report does not establish the design used in the reseller-linked thefts. Ledger has not publicly described the implant it found.

Three Loss Estimates, Three Different Numbers

Losses are still being counted, and the counts disagree. Third-party on-chain researchers put the total between $86 million and $93 million from more than 300 wallets on Bitcoin, Ethereum and Tron.

• Bitquery's Oct. 11 update counted about $93.2 million in suspected thefts from 315 wallets across six blockchains.
• Alex Thorn of Galaxy Digital reported on Oct. 9 about $91 million across 477 addresses, including $64.5 million on Tron, of which roughly 64.3 million was USDT. He put Bitcoin at $17.7 million, about 213 BTC, and Ethereum and related networks at $8.8 million.

The two estimates use different address sets and methods, and neither counts the number of tampered devices, so neither is a headcount of affected owners.

Bitquery's analysis adds a timeline worth knowing. It found that 25 Tron wallets signed the same token approval within three seconds, allowing about $29 million in USDT to be withdrawn in moments, and that small test transactions ran for roughly two weeks before the larger thefts. Tether has frozen about $10 million in stolen USDT, according to Bitquery, which also identified $5.35 million in USDC that Circle could freeze after funds moved through Tornado Cash and Zcash.

What Ledger Is Telling Users Now

The guidance is short and specific.

• Do not initialize unused devices.
• If a device is already set up, move to a new seed on a device from Ledger.
• Ledger also told distributors to source products exclusively through authorized channels and prohibited the restocking of returned products.
• The company repeated that it will never call, DM or ask for a 24-word recovery phrase.

Tibane Labs warned that a recovery phrase displayed on a compromised device should be treated as exposed, which is why the advice points to a new seed rather than a new screen.

CryptoBilis has suspended sales of all hardware wallet inventory until the investigation concludes. Ledger says it is cooperating with relevant authorities. Binance co-founder Changpeng Zhao alleged that the attackers bought the reseller and made it sign a non-disclosure agreement, a claim that has not been independently verified.

What remains open is the part owners would most like answered: how many devices were modified, which models, and whether the implant caused all the reported losses. Ledger has not said. For scale, a July 2026 flaw in Coldcard's seed-generation firmware let attackers drain an estimated $100 million to $130 million in bitcoin, a larger figure than the top end of this week's estimates.