Ledger has confirmed that some of its hardware wallets sold through CryptoBilis, which BleepingComputer describes as a Malaysia-based retailer operating across Southeast Asia, were physically altered. A hidden implant captured each owner's recovery phrase and sent it off the device. Funds were drained from affected wallets on October 9, according to The Record. Since then the response has widened from one reseller to a whole region. On October 14, Ledger asked resellers and distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to stop selling its wallets and pull them from shelves while it investigates.

Ledger says it believes the number of affected devices is limited. It has not confirmed total losses or which models were affected, and it urged caution about speculation, The Record reported.

How the investigation unfolded

Ledger opened an investigation on October 9 after users reported losses, and told CryptoBilis to stop selling its products, according to BleepingComputer. On October 10, Ledger confirmed it had found an unauthorized implant in a device. In an update the following day, it said every user report of unexpected fund drains was linked to devices sold through CryptoBilis.

On October 13, Ledger's Donjon security team shared technical details of the implant, largely confirming earlier reports by researcher Mark Karpelès and Tibane Labs. Ledger's statements that day came in a series of social media posts. On October 14, it extended the sales halt to distributors across Southeast Asia and Hong Kong.

CryptoBilis said in a notice that it has "paused all sales and shipments of Ledger devices while Ledger investigates" and is "cooperating fully" with the investigation, The Record reported. Ledger says its own infrastructure, systems, services and direct sales channel are safe to use.

What the implant does

According to Donjon, the implant is a separate microcontroller added inside the wallet. It detects and decodes the 24-word recovery phrase while the owner sets up or restores the device, then sends it out over LTE using a provisioned eSIM. Karpelès, who published photos of the implant, said it captured the display output and button presses to obtain the phrase.

Tibane Labs found two versions of the implant in Nano X devices. One swapped the original battery for a smaller one. The other ran on the original battery and fit into the foam padding under the OLED display. Some chip markings had been scraped off. Researchers have been publicly showing the implant since September 16, according to BleepingComputer.

Donjon says the implant does not modify the Secure Element, the tamper-resistant chip that holds the keys, or Ledger's operating system, and it does not alter transactions or signatures. That is why Ledger's integrity self-checks do not flag it. Ledger warns that its Genuine Check cannot detect added implants when the device's original Secure Element remains intact, so a tampered device may still pass its authenticity checks.

Where tampered devices turned up

CryptoBilis is the only reseller Ledger has linked to confirmed thefts. Reports of modified devices have come from other channels as well:

  • Discounted listings: Tampered devices sold for nearly half the price of genuine hardware, according to BleepingComputer. Tibane Labs bought its samples on Amazon Japan and Yahoo! Auctions Japan. Karpelès said his device came from a Chinese seller shipping from Malaysia.
  • Singapore airport: Users reported modified devices bought from Metapod, a tech retailer at a Singapore airport.
  • Europe: Users reported modified devices bought from MediaMarkt, which sources Ledger products from distributor Aqipa GmbH. MediaMarkt pulled the product after the reports.

Ledger has said it is reviewing reports of implants in other signers and locations, according to The Record.

How other wallet makers are responding

Rival maker Trezor said it has found no evidence its own devices were compromised. As a precaution it is shrinking its reseller network, tightening legal terms and checking more closely how partners source and handle devices. Its partnerships with affected resellers end on January 1, 2027. "Supply-chain security is never finished, so we are raising the bar for every partner who continues with Trezor," the company said, as quoted by BleepingComputer.

What is still unknown

  • Total losses: Ledger has not confirmed a figure.
  • Affected models: Researchers documented the implant in Nano X units, but Ledger has not named the affected models.
  • How many devices: Ledger has not said how many devices were modified or how they entered the reseller chain.
  • Other sellers: Ledger has not said whether the devices reported from Metapod or MediaMarkt have been confirmed as tampered.

What It Means for Defenders

  • Unopened CryptoBilis devices: Ledger said in its social media posts: "If you bought a Ledger signer from CryptoBilis and have not set it up, do not set it up and contact Ledger Support."
  • No recovery phrases on suspect devices: "Do not enter or restore any recovery phrase on a signer bought from CryptoBilis," Ledger said.
  • CryptoBilis devices already set up: Ledger advises moving assets promptly to a new signer with a newly generated recovery phrase.
  • Victims: Ledger asks affected users to contact Ledger and local law enforcement before opening or shipping a device.
  • Procurement: Ledger advises against buying from unauthorized resellers. Organizations holding crypto assets should buy signing hardware from the manufacturer or authorized distributors, record where each device came from, and treat a passing Genuine Check as insufficient proof for devices from other channels.

Sources