Ledger has confirmed that a hardware implant found in some of its devices caused cryptocurrency thefts from user wallets. The affected devices were distributed through CryptoBilis, a Malaysia-based reseller that operates across Southeast Asia. The company said it is contacting impacted users as part of its ongoing investigation. Ledger also said it is working with authorities to identify whoever is responsible.
The confirmation followed several days of mounting reports. Ledger announced on October 9 that it had opened an investigation into user reports of lost funds and told CryptoBilis to stop selling and shipping its devices. The next day, the company confirmed hardware tampering on at least one device, though it said it still did not know exactly how or when the tampering occurred. In a further update, Ledger said every report of unexpected fund drains was tied to devices sold through CryptoBilis and described the affected volume as limited. The company has not disclosed which device models were compromised in the supply-chain attack.
Security researchers have focused on the Ledger X. Mark Karpeles, who leads Karpeles Lab Inc. and serves as CTO at Shells.com, published an image of an implant he said was hidden behind the device's screen, calling it a significant advance over earlier versions that used hand-soldered wires. According to Karpeles, the hardware captured screen output and button presses to reconstruct the seed phrase, then sent it to an attacker over an LTE connection using an eSIM. He said the device came from a well-known platform through a Chinese seller, shipped from Malaysia, rather than through Ledger's recommended channels.
Tibane Labs, a cryptocurrency research and development studio, said it confirmed the finding and identified two versions of the implant. The researchers said they obtained one from a Ledger device bought on Amazon Japan from a China-based seller shipping from Malaysia, and the other through Yahoo! Auctions Japan. In both, the implant made space by swapping the original battery for a smaller one that powers the tampered device and the added circuitry. One variant carried an ST STM32G431KBU6 chip alongside a small eSIM and a shielded LTE module, while the second, described as more advanced, ran on the original battery and fit under the OLED display. In the second device, part numbers on the microcontroller and eSIM had been scraped off.
Ledger advised anyone who bought a device from the reseller not to begin setup if they have not already done so, and said users who have set up such a device should consider moving their assets to a new Ledger signer with a new seed. The company has not named CryptoBilis as the source of the devices in Karpeles' account. For US buyers, the case highlights the risks of purchasing hardware wallets outside official channels, since a tampered device can appear genuine while capturing the seed phrase that controls stored assets.
More hardware news from TechManNews.
