Ledger Confirms a Spy Implant in Reseller-Sold Wallets

What Ledger Has Confirmed, Day By Day

Ledger confirmed on 10 October 2026 that a device belonging to an affected user contained an unauthorized hardware implant, and it says every confirmed case traces to units sold through one Southeast Asian reseller, CryptoBilis.

Ledger says it has no indication that its own systems or services were compromised, and The Verge reports no sign that wallets bought directly from Ledger are affected. Ledger has not said how or when the tampering happened, or how many devices carry an implant.

How The Implant Works

Former Mt. Gox chief Mark Karpelès published a photo of the implant in a Ledger Nano X. He says it sits behind the screen, captures the display output and the button presses to work out the seed phrase, and sends it to the attacker over LTE through an eSIM.

Tibane Labs, a crypto research studio, confirmed the finding and described two variants. One squeezes in by swapping the original battery for a smaller one that powers both the wallet and the implant. The other runs on the original battery and fits into the foam padding under the OLED display. The board is a professionally made flex circuit, in the researchers' words not a hand-built one-off, and in both variants the antenna wire was the visible tell.

Tibane obtained its two units on Amazon Japan, from a China-based seller shipping from Malaysia, and on Yahoo! Auctions Japan. Karpelès says his came through a well-known platform and a Chinese seller, not Ledger's recommended channels, and he did not name CryptoBilis. Ledger has not confirmed that the implant explains every drain.

How Big The Loss Is, And Who Is Counting

Nobody has verified the losses: three on-chain estimates sit between $86 million and about $93 million, and Ledger has confirmed none of them.

Customers who bought through CryptoBilis in Indonesia, Malaysia and the Philippines were reported as affected. An unconfirmed post on X claims a Ledger bought at MediaMarkt in Europe may also show manipulation. Ledger has not confirmed it and users examining the pictures disagree: some say the board looks inconsistent with a genuine Ledger, others do not see the same extra implant. MediaMarkt is an official Ledger reseller in several European markets, including Germany and Austria.

What A Buyer Of Security Hardware Should Do

A tampered security device defeats every control that runs on it, because the control runs on hardware the attacker already holds. Ledger's own Genuine Check cannot detect an added implant when the original Secure Element is intact, so a passing check proves little.

Buy from the maker or from a reseller you have verified on the maker's own site. Ledger tells users to avoid unauthorized resellers and tells resellers to source only through authorized channels and never restock returned products. The reporting we read does not settle whether CryptoBilis was on Ledger's list, so for a device that guards company funds, buy direct.

Never use a device that arrives with a recovery phrase already printed or written. CryptoBilis's own alert says the phrase must be generated by the device during setup and written down by the user. Ledger advises anyone who bought from this reseller to hold off setup, or if setup is done, to move assets to a new signer with a new seed. Ledger says it will never ask for your 24-word phrase.

Apply the same routine to tokens, HSMs and network gear: record serial numbers on receipt, open the packaging with a second person, and treat a price near half the list price as a finding, not a bargain.

Read next: Nvidia Turns Hugging Face Into a Chokepoint  |  AMD Crosses 30 Percent of Every x86 Chip Segment