Ledger confirms spy-chip implant in Nano X wallets sold through reseller CryptoBilis

Ledger has confirmed that an unauthorised hardware implant hidden inside some of its wallets was used to steal users' cryptocurrency, and that every report of unexpected fund drains it has received is tied to devices distributed through a single reseller, CryptoBilis. According to BleepingComputer, the Malaysia-based retailer is a major hardware wallet vendor operating across Southeast Asia, and Ledger describes the volume of affected devices as limited.

The company opened an investigation on October 9 after users reported losing funds, and asked CryptoBilis to stop selling and shipping Ledger products. The next day it verified tampering on at least one device, though how and when the modifications were made remains unclear. Ledger says it is working with authorities to identify whoever is responsible.

How the implant works

Independent researchers had been demonstrating compromised hardware since September 16, and one early warning sign was price: tampered units were on sale for close to half the cost of a genuine device.

Mark Karpelès, the former Mt. Gox chief executive who now leads Karpeles Lab and is CTO at Shells.com, published images of the implant inside a Ledger Nano X. He described it as a significant step up from earlier versions that relied on hand-soldered wiring. The component sits concealed behind the screen, but its antenna cable would have been visible to anyone who opened the case.

In Karpelès' analysis, the malicious circuitry monitors the device's display output and button presses in order to reconstruct the seed phrase — the recovery words that control a wallet's funds — and transmits them to the attacker over an LTE connection using an embedded eSIM. He noted that his sample was not bought through Ledger's recommended channels but from a well-known platform via a Chinese seller, with the product shipped from Malaysia.

Two variants in the wild

Tibane Labs, a cryptocurrency research and development studio, corroborated the finding and documented two distinct implant designs. One compromised device was purchased on Amazon Japan from a China-based seller shipping from Malaysia; the other came from Yahoo! Auctions in Japan.

In the first variant, the attacker swapped the original battery for a smaller one that powers both the implant and the wallet itself. The added board carried an ST STM32G431KBU6 microcontroller (an Arm Cortex-M4 part with 128 KB of flash in a UFQFPN-32 package), a tiny eight-pad eSIM measuring 2×2 mm, and a shielded LTE module to exfiltrate the seed words. Its antenna was taped across the top of the battery and radio module.

The second design is more advanced. It runs on the device's original battery and fits into the space normally filled by foam padding beneath the OLED display, with its antenna running along the top edge. On that unit, the markings on both the microcontroller and the eSIM had been scraped off to obscure the components. Tibane Labs emphasised that the boards were designed, panelised flex PCBs of the kind ordered from a professional board house, not hand-built one-offs — evidence of a production-grade operation.

Ledger has not disclosed which device models were compromised, but online reports point to the Nano X.

Ledger's response and user guidance

Ledger advises anyone who bought a device from this reseller and has not yet initialised it to stop and not proceed with setup. Users who have already set up a device purchased through CryptoBilis should move their assets to a fresh Ledger device initialised with a new seed phrase.

The company also warned that its Genuine Check feature, which verifies a device's authenticity, cannot detect added implants when the original Secure Element is left intact — a significant gap given that the tampered units otherwise appear legitimate. Ledger urges customers to buy only through authorised channels and has reminded its authorised resellers and distributors to source stock properly and to avoid restocking returned products.

There is currently no indication that other Ledger resellers shipped compromised wallets.

Why it matters

Hardware wallets exist to move trust out of software and third parties and into a physical device the user controls. A supply-chain attack that implants spy hardware inside a genuine-looking unit — one that can pass the vendor's own authenticity check — undermines that core promise entirely.

The incident also shows how far hardware implants have evolved: compact, professionally manufactured boards with cellular connectivity, mass-produced rather than hand-assembled. For crypto users, the practical lessons are blunt. Deep discounts on security hardware are a red flag, buying direct or through verified channels matters, and in this case only physical inspection would have revealed the tell-tale antenna. The reputational damage may outlast the incident itself: parts of the Ledger community are already calling for the reseller network to be dismantled.