Ledger has confirmed the discovery of an unauthorized hardware implant in a device belonging to one affected customer, the company stated on October 10. The finding comes as independent investigators estimate approximately $93.2 million in suspected cryptocurrency thefts connected to devices purchased from CryptoBilis, an authorized reseller operating in Southeast Asia.
CryptoBilis has suspended sales of all hardware wallet inventory pending the investigation's conclusion. The thefts began after customers reported losing cryptocurrency following purchases from the reseller, though Ledger has not disclosed how many devices were modified or confirmed that the implant caused all reported losses.
Ledger stated it had found no indication that its security infrastructure, systems, or services had been compromised.
How the Implants Bypassed Security Checks
Researchers examining the suspicious devices through Tibane Labs, led by former Mt. Gox chief executive Mark Karpelès, documented three generations of implants designed to intercept recovery phrases. The research combined an earlier teardown with two specimens examined in September.
According to the analysis, the implants monitor electronic signals between a wallet's secure element and its display. During setup, Ledger devices generate a 24-word recovery phrase stored in a secure chip. To display these words on screen, the data must pass through the device's display circuitry—a point where the implants intercept.
The modified devices contained additional microcontrollers capable of reading the screen's data, reconstructing recovery words, and transmitting them via cellular modems with SIM components. This allowed attackers to obtain credentials needed to reconstruct a victim's wallet remotely.
Earlier implant versions used visible wiring and smaller replacement batteries. A more advanced version examined in September contained a custom circuit board hidden under the screen, featuring an LTE modem, antenna, and components with removed identifying markings. This version preserved the original battery and could appear normal even when opened.
Ledger's security documentation states that its Genuine Check verifies the secure element's authenticity but cannot detect unauthorized physical modifications if the secure element remains intact.
Theft Estimates and Transaction Patterns
Galaxy Digital research executive Alex Thorn reported approximately $91 million across 477 addresses on Bitcoin, Ethereum-related networks, and Tron as of October 9. Of this total, $64.5 million was attributed to Tron—including approximately 64.3 million USDT—with Bitcoin accounting for $17.7 million and Ethereum and related networks contributing $8.8 million.
Blockchain analytics firm Bitquery, in an October 11 update, counted approximately $93.2 million in suspected thefts from 315 wallets across six blockchains. The two estimates use different address sets and methods and do not count the number of tampered devices.
Bitquery identified transaction patterns suggesting attackers obtained control of multiple wallets before executing a coordinated withdrawal on October 9. Analysis showed that 25 Tron wallets signed the same token approval within three seconds, enabling approximately $29 million in USDT to be withdrawn moments later.
The firm also documented small test transactions conducted over roughly two weeks before the larger thefts, indicating preparation began well before users reported missing funds. Bitquery estimated that Tether had frozen approximately $10 million in stolen USDT, while Circle could freeze $5.35 million in USDC after funds moved through Tornado Cash and Zcash.
Ledger's Response and Recommendations
Ledger stated it was contacting affected users, coordinating with authorities, and working on enhanced anti-tampering protections. The company advised customers who purchased devices from CryptoBilis not to initialize unused wallets. Those who have already completed setup should transfer their holdings to a trusted device using a newly generated recovery phrase.
Researchers cautioned that a recovery phrase displayed on a compromised device should be treated as exposed. Replacing the device while reusing the same phrase would leave attackers able to access the wallet; funds must move to a wallet with a new phrase generated on a trusted device.
