Ledger has confirmed that some of its hardware wallets sold through Southeast Asian reseller CryptoBilis were compromised with a spy chip implant, leading to cryptocurrency thefts from users' wallets. The company launched an investigation on October 9 after reports of users losing funds from devices purchased through CryptoBilis, a major Malaysia-based retailer. Researchers revealed that tampered Ledger X devices were available at nearly half the price of the original hardware, raising suspicions about their authenticity.
On October 10, Ledger confirmed that at least one device contained an unauthorized hardware implant. The company is working with authorities to identify the perpetrator and is advising affected users to move their assets to new Ledger signers with fresh seed phrases. Ledger has also warned users to avoid setting up devices purchased from CryptoBilis and has asked the reseller to halt sales and shipments of Ledger devices.
Mark Karpelès, CTO at Shells.com, shared details of the implant, which was concealed behind the screen but featured an antenna cable that could indicate tampering. The implant captured the device's display output and button presses to steal seed phrases, transmitting the data to attackers via an LTE connection using an eSIM. Tibane Labs, a cryptocurrency research studio, confirmed Karpelès' findings and identified two implant versions, both involving sophisticated circuitry hidden within the device.
Ledger advises users to purchase devices only from authorized channels to avoid counterfeit or modified products. The company's 'Genuine Check' mechanism cannot detect added implants if the device's original Secure Element remains intact. While there is no evidence of other resellers shipping compromised wallets, the incident has shaken trust in the resellers' network, with calls for its dismantling.