A cryptocurrency retailer in Kuala Lumpur, CryptoBilis, has become the center of an investigation after customers reported missing funds from hardware wallets. Losses are estimated at over $90 million, with blockchain researchers tracking the thefts back to October 9. Ledger SAS, the Paris-based manufacturer of the affected wallets, revealed that a highly organized criminal group had fitted some devices with hidden hardware. While Ledger initially linked the issue to CryptoBilis, reports of implants in wallets purchased elsewhere suggest the problem may be more widespread.
The incident highlights vulnerabilities in what was once considered cryptocurrency’s safest tool. Multiple hacks over the past few months have shown that even physical devices designed to keep digital money offline can be compromised. Esme Pau, head of capital markets and policy at blockchain security firm CertiK, noted that this reveals crypto storage as an operational risk, not just a cryptographic one. Real-world security, she said, depends on the entire process.
Ledger is conducting an investigation with local law enforcement and plans to share more information when available. Social-media sleuths have investigated how the implants work, suggesting that secret hardware intercepts passcodes sent to Ledger screens and transmits those keys over cellular connections to hackers. This breach is distinct from previous issues, as it involves physical tampering rather than software or data-security flaws.
Ben Yorke, a crypto industry worker in Kuala Lumpur, noticed suspicious markings on a Ledger Flex he purchased at Singapore’s Changi Airport. He sent the device to Mark Karpelès, a crypto founder-turned-researcher, who identified a custom connector tapping into the display, along with a cellular chip and SIM card. Karpelès described the technology as more sophisticated than expected, suggesting it was not the work of an amateur but rather a highly organized operation.