Ledger confirms hardware implant in Ledger X devices linked to crypto thefts
On October 12, 2026, Ledger confirmed that some of its devices distributed through Southeast Asian reseller CryptoBilis were compromised with a hardware implant that drained users' cryptocurrency wallets. The company launched an investigation on October 9 after receiving reports of unexpected fund losses from users who purchased Ledger devices via CryptoBilis, a Malaysia-based hardware wallet retailer operating across the region. The following day, Ledger confirmed hardware tampering on at least one device, stating that an unauthorized hardware implant was present in one impacted user’s device.
Ledger emphasized that it is working with authorities to identify the perpetrator and advised users who purchased devices from CryptoBilis not to set them up if they have not already done so. For those who have completed setup, Ledger recommended moving assets to a new Ledger signer with a fresh seed phrase.
Details of the spy implant in Ledger X devices
Researchers first highlighted the issue on September 16, showing tampered Ledger X devices being sold for nearly half the price of genuine units. Mark Karpelès, CEO of Karpeles Lab Inc. and CTO at Shells.com, shared an image of the implant, describing it as "quite an evolution" from earlier versions that used manually soldered wires. He explained that the malicious hardware was concealed behind the screen, with its antenna cable being a potential giveaway of tampering.
According to Karpelès, the implant captured the device’s display output and button presses to extract the seed phrase, then transmitted it to attackers via an LTE connection using an embedded eSIM. He stated that while Ledger Nano X devices are designed to securely store private keys, the spy implants were specifically designed to steal whatever cryptocurrency users stored in them.
Karpelès noted that the compromised device was not purchased through Ledger’s recommended channels but obtained from "a well known platform via a Chinese seller (product shipped from Malaysia)." He did not name CryptoBilis directly as the vendor.
Tibane Labs confirms two variants of the implant
Tibane Labs, a cryptocurrency research and development studio, independently verified Karpelès’ findings and identified two distinct versions of the implant in Ledger X devices. One variant was found in a device bought on Amazon Japan from a China-based seller shipped from Malaysia; the other came from a device purchased on Yahoo! Auctions, Japan.
In the first variant, researchers discovered that the threat actor replaced the original battery with a smaller one to make space for the malicious circuitry. This battery powers both the implant and the Ledger X device. Inside, they found an ST STM32G431KBU6 microcontroller (Arm Cortex‑M4, 128 KB flash, UFQFPN‑32 package), a tiny 2×2 mm 8‑pad eSIM, and a shielded LTE module responsible for transmitting stolen data.
In the second variant, the implant was designed to fit into the foam padding space under the OLED display and operated using the original battery. Researchers observed that in both versions, the antenna wire ran along the top edge of the device — a key telltale sign of tampering. In the first implant, the antenna was taped across the top of the battery and shielded LTE module; in the second, it ran along the top edge of the case.
Tibane Labs warned that the implant used a "designed, panelised flex PCB" ordered from a board house, indicating a sophisticated, industrial-scale operation rather than a hand-built prototype. In the second device, markings on both the MCU and eSIM had been scraped off to obscure part numbers and hinder detection.
Ledger’s response and security guidance
Ledger reiterated that its ‘Genuine Check’ mechanism can verify device authenticity but cannot detect hardware implants if the original Secure Element remains intact. The company maintains that, as of the latest update, all reported cases of unexpected fund drains are linked exclusively to devices sold through CryptoBilis, describing the affected volume as "limited."
There is currently no evidence that other authorized resellers are distributing compromised devices. However, Ledger urged users to only purchase hardware wallets through official or authorized channels and advised authorized distributors to avoid restocking returned products. The company also warned that the incident has eroded trust in the broader reseller network, with many in the community calling for its restructuring or dismantling.
Source: BleepingComputer