Ledger confirmed that one of its wallet devices sold through Malaysian distributor CryptoBilis contained an unauthorized hardware implant, following reports that users had lost crypto assets from devices they purchased through the distributor, which operates in Southeast Asia.
Ledger began investigating on October 9, 2026, and asked CryptoBilis to stop selling and shipping its devices. The following day, the company acknowledged hardware tampering in at least one device, then said in a subsequent update that all reports of unexpected withdrawals it had reviewed were linked to devices sold through CryptoBilis, describing the number of cases as “limited.” The company still has not specified when or where the devices were modified.
How did the implant work?
Researchers’ reports said that the affected devices, attributed to the Ledger X model, contained a malicious circuit hidden inside the enclosure. According to an analysis by Mark Karpelès and Tibane Labs, the implant was designed to capture screen output and button presses in order to identify the recovery phrase, then send it to the attacker over an LTE connection using an eSIM.
Tibane Labs researchers identified two versions of the implant. In one sample, the original battery was replaced with a smaller one to make room for a circuit containing an ST STM32G431KBU6 microcontroller, an LTE module, and an eSIM measuring approximately 2×2 millimeters. The second version used the space beneath the OLED screen and operated with the original battery. In both samples, antenna wires appeared along the top of the device as a physical sign of modification, while the markings on some components in one sample had been scraped off to conceal their identity.
Why does this matter?
The incident exposes the limits of relying solely on the integrity of internal security components. The implant does not necessarily need to directly break the Secure Element; it can monitor what is displayed to the user and what the user enters through the buttons, then transmit the data through an independent communications channel. Ledger says that the Genuine Check mechanism can verify a device’s authenticity, but it cannot detect hardware additions if the original Secure Element remains intact.
In practice, Ledger recommended that anyone who bought a device from CryptoBilis and has not yet started setting it up should not turn it on. Those who completed the setup should consider transferring their assets to a new signing device using a new recovery phrase. This recommendation addresses not only the potentially compromised devices, but also assumes that the recovery phrase may have been compromised.
What remains unresolved?
Ledger has not officially disclosed the models of the affected devices, nor has it identified the party that carried out the modification or the point at which it entered the supply chain. The samples analyzed by researchers indicate devices purchased from sellers linked to China and shipped from Malaysia, but that alone does not establish the responsibility of any particular seller. According to the available information, there are no indications of involvement by other distributors.
Ledger recommends purchasing through authorized channels and asks its distributors not to restock returned products. The incident shows that supply-chain integrity remains an essential part of hardware-wallet security, even when software verification mechanisms and the original device appear to be intact.