Ledger confirms hardware spy implant in devices sold by CryptoBilis

Ledger has confirmed that some of its hardware wallets distributed through the Southeast Asian reseller CryptoBilis contained unauthorized spy implants. These tampered devices were linked to incidents where user cryptocurrency wallets were drained, prompting an immediate investigation and sales halt by the wallet manufacturer.

The company launched this inquiry on October 9 after receiving user reports of unexpected cryptocurrency losses linked to purchases from CryptoBilis. By the following day, Ledger verified hardware tampering on at least one specific device, though it is unclear exactly how or when the devices were tampered with. The firm is now coordinating with authorities to identify the perpetrators responsible for the supply-chain attack.

Context and Background

Reports of the hardware implant in Ledger X devices first surfaced on September 16, according to BleepingComputer. Researchers noted that these tampered units were available for nearly half the price of legitimate hardware. The significant price difference was observed by researchers who analyzed the devices, but the source does not specify buyer motivations or awareness levels regarding the discount.

Ledger wallets function as physical security keys that store private keys controlling cryptocurrency assets. The integrity of these devices is critical because they authorize transactions offline. The discovery of a hardware implant involves unauthorized components within the device, which researchers have shown to be concealed behind the screen in Ledger X units, marking an evolution from previous tampering methods.

Who Is Affected

Ledger stated that all reported cases of unexpected fund drains were linked to devices purchased through CryptoBilis. The company described the affected volume as limited but did not specify the total number of compromised units or the exact financial losses incurred by victims during the ongoing investigation.

Mark Karpelès, former CEO of Mt. Gox and current CTO at Shells.com, shared images of the implant found inside Ledger X devices. He described the modification as an evolution from previous methods, noting that while earlier versions used manually soldered wires, this new implant was concealed behind the screen, though its antenna cable remained visible.

Ledger has asked CryptoBilis to cease all sales and shipping of its products. The retailer, based in Malaysia, operates across Southeast Asia and was a major distributor for the brand. Users who bought devices from this specific channel are the primary focus of the current response efforts and user outreach programs.

What should you do?

Ledger has issued specific guidance for users who purchased devices from CryptoBilis. Those who have not yet set up their hardware wallets are strongly advised not to initiate the setup process. For users who have already configured their devices, the company recommends transferring assets to a new Ledger signer that utilizes a completely new seed phrase to ensure security.

The wallet maker is actively reaching out to impacted users as part of its ongoing investigation. While no patch or software fix can remove a physical hardware implant, changing the seed phrase on a new, verified device effectively isolates the user’s assets from the compromised hardware’s reach.

What to do and how to stay safe: Ledger

• Verify your purchase source and confirm you did not buy your device from CryptoBilis or unauthorized third-party retailers.
• If you bought from this reseller, do not set up the device; if already set up, move assets to a new device with a new seed.
• Monitor your cryptocurrency addresses for any unauthorized transaction attempts or unexpected outgoing transfers.
• Purchase hardware wallets only from the manufacturer’s official website or authorized, verified distribution channels.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Ledger devices are affected by the spy implant?

Reports indicate that Ledger X devices were compromised, though Ledger has not officially disclosed the specific model types in its public statements.

Did Ledger find a software fix for the implant?

No software fix exists for a physical hardware implant; the recommended solution is to move assets to a new device with a new seed phrase.

Who was selling the compromised devices?

The compromised devices were sold by CryptoBilis, a major Malaysia-based hardware wallet retailer operating across Southeast Asia.