\n
![](\"https:\/\/media.crypto.news\/2023\/10\/crypto-news-Everscale-announced-theft-of-tokens01.webp\")
<\/p>\n
\n<\/p>\n
Ledger has confirmed finding an unauthorized hardware implant inside one customer\u2019s cryptocurrency wallet during its October 10 investigation into reported thefts involving Southeast Asian reseller CryptoBilis, as blockchain researchers estimate suspected losses exceeding $86 million.<\/p>\n
\n Summary<\/span>\n <\/p>\n <\/p>\n Ledger Support confirmed<\/a> the discovery in an official statement, saying the modified device belonged to a user affected by the ongoing investigation. The company said CryptoBilis had stopped selling all hardware wallets as a precaution and that Ledger was contacting affected customers while working with authorities. It has not established whether the implant caused the reported cryptocurrency losses.<\/p>\n Situation Update: Ledger can confirm that one of the impacted users\u2019 devices contained an unauthorized hardware implant. Ledger is reaching out to impacted users as part of the ongoing investigation. If you have information regarding the investigation, please reach out to\u2026<\/p>\n \u2014 Ledger Support (@Ledger_Support) October 10, 2026<\/a><\/p><\/blockquote>\n<\/div>\n<\/figure>\n The discovery provides direct confirmation of physical tampering in at least one device, following earlier warnings about suspicious wallets distributed through the reseller.<\/p>\n <\/p>\n During its investigation, Ledger identified an additional electronic component inside a wallet belonging to an affected customer.<\/p>\n The company described the component as an \u201cunauthorized hardware implant\u201d but did not disclose the exact device model, how the component was installed or whether it had transmitted any information.<\/p>\n According to Ledger\u2019s October 10 statement, its security team is examining the incident and contacting customers believed to have been affected. The manufacturer has not confirmed how many wallets contain similar modifications.<\/p>\n Reports of unauthorized transactions emerged on October 9 among customers who purchased Ledger products through CryptoBilis, a reseller operating in Indonesia, Malaysia and the Philippines. Following the complaints, Ledger opened an investigation into the reported losses and asked the distributor to suspend sales and shipments of its devices.<\/p>\n A subsequent report<\/a> from The Block said on-chain investigators had initially identified suspected thefts exceeding $72 million, while another estimate placed the losses above $86 million.<\/p>\n Ledger has not confirmed either amount. The company emphasized in its latest statement that it has found no evidence suggesting its internal security infrastructure, systems or services were compromised.<\/p>\n \u201cWe have no indication that Ledger\u2019s security infrastructure, systems or services have been compromised,\u201d the company stated.<\/p>\n The manufacturer is developing additional protections against physical device tampering while investigators work to determine how the unauthorized component entered the affected wallet.<\/p>\n Following Ledger\u2019s discovery, CryptoBilis confirmed that it had suspended sales of its entire hardware wallet inventory.<\/p>\n The temporary halt covers all hardware wallet products sold by the distributor, extending beyond the earlier request to pause Ledger sales and shipments.<\/p>\n According to an October 10 report<\/a> from TokenPost, CryptoBilis will maintain the suspension until the investigation concludes.<\/p>\n Ledger said it remained in active communication with the reseller regarding the investigation and appropriate next steps. Customers who purchased a device through CryptoBilis have been instructed not to begin setting it up if they have not already done so.<\/p>\n For customers who have used the devices, Ledger recommends considering a transfer of their cryptocurrency to a new hardware wallet initialized with a completely new recovery phrase. Moving an existing recovery phrase onto a replacement device would not address possible exposure of that phrase through the original hardware.<\/p>\n The company further requested information from anyone with relevant evidence and directed security researchers to its bounty program at [email\u00a0protected]<\/span><\/a>. Ledger has contacted law enforcement and acknowledged assistance from the Security Alliance\u2019s SEAL_911 incident response initiative.<\/p>\n The company\u2019s statement did not identify any suspects, announce arrests or provide a timetable for completing the investigation. Separately, former CryptoBilis executives Arravind Prabu and Vimalatheethan stated that they had transferred operational control of the business following an ownership change earlier in 2026.<\/p>\n In a statement shared with researcher Mark Karpel\u00e8s and published by Tibane Labs, the former executives said they completed their management handover in March and no longer controlled company systems or customer databases.<\/p>\n Their statement does not establish who modified the affected device or whether the ownership change had any connection to the incident.<\/p>\n Before Ledger publicly confirmed the hardware implant, former Mt. Gox CEO Mark Karpel\u00e8s reported examining a suspicious Ledger Nano X device obtained from Malaysia. On October 9, Karpel\u00e8s described finding an additional electronic component hidden behind the device\u2019s display, inside material normally used to protect the screen.<\/p>\n He reported that the wallet had arrived in packaging that appeared intact, raising questions about whether customers could identify a modified device through a routine visual inspection. In photographs shared publicly, the component appeared to contain electronic circuitry separate from the wallet\u2019s original hardware.<\/p>\n Karpel\u00e8s subsequently reported examining the modification further and inspecting images provided by other affected users.<\/p>\n A technical account published<\/a> by Tibane Labs described an arrangement involving a microcontroller, cellular communication hardware and connections to the screen\u2019s internal data lines. The analysis suggested that a component positioned along the screen connection could potentially capture information displayed during wallet setup.<\/p>\n A recovery phrase typically consists of 24 words that allow a wallet owner to restore access to cryptocurrency holdings. If an attacker obtains those words, the attacker may be able to recreate the wallet and authorize transfers without possessing the original hardware device.<\/p>\n Researchers have suggested that an implant capable of reading information sent to the display could potentially capture recovery words when a wallet is initialized.<\/p>\n However, Ledger has not independently confirmed that the discovered implant performed that function or that it was responsible for the reported thefts.<\/p>\n The company\u2019s official announcement confirms physical tampering in one affected device without establishing the technical method used to access customer funds. Ledger\u2019s historical security research has previously examined situations involving unauthorized modifications to wallet hardware.<\/p>\n In a 2018 security response<\/a>, the manufacturer discussed how attackers with physical access could modify a wallet and use additional electronics to interfere with its operation. The earlier research concerned different attack scenarios and did not establish a connection to the CryptoBilis investigation.<\/p>\n As investigators examine the affected hardware, blockchain analytics researchers have attempted to calculate the value of cryptocurrency moved from suspected victim wallets.<\/p>\n In an October 9 investigation, Bitquery estimated<\/a> that approximately $92.9 million had been removed from 311 wallets across Bitcoin, Ethereum, TRON, BNB Chain and Polygon.<\/p>\n The estimate exceeded earlier reports of suspected losses ranging from $72 million to more than $86 million. Bitquery attributed the difference to additional wallets and blockchain networks included in its analysis. Its researchers reported that the largest portion of the suspected losses involved USDT transactions on TRON, followed by Bitcoin and Ethereum transfers.<\/p>\n The report identified approximately $70.5 million in assets transferred from TRON wallets and $16.8 million in Bitcoin. Using transaction timing and address relationships, Bitquery argued that the activity was consistent with an attacker already possessing control over multiple wallets.<\/p>\n The research company identified closely timed transactions across several networks and examined where the transferred assets subsequently moved. Bitquery reported that approximately $10 million in USDT had been frozen in addresses linked to the suspected thefts.<\/p>\n It further identified transactions involving cryptocurrency swaps and transfers to Tornado Cash, a service used to obscure the transaction history of digital assets. The analysis remains an independent assessment. Ledger has not confirmed Bitquery\u2019s estimated losses, number of victims or conclusions about the attacker.<\/p>\n More recent on-chain reporting<\/a> from PublicAML described additional movements involving suspected stolen Ether on October 10, including transfers to Tornado Cash. The analysis estimated that 900 ETH reached Tornado Cash during another series of transfers, although the researchers\u2019 wallet attribution and loss calculations remain separate from Ledger\u2019s confirmed findings.<\/p>\n Ledger\u2019s investigation has prompted warnings about the possibility of criminals exploiting public concern surrounding the reseller incident. The company cautioned customers to rely on official communication channels for information about affected devices, investigations and potential security measures. Its public statement reminded customers that Ledger support personnel will never request their 24-word recovery phrase.<\/p>\n Earlier research into fraudulent Ledger websites<\/a> documented phishing pages that attempted to obtain recovery phrases through fake wallet verification requests.<\/p>\n The report, published October 11, discussed malicious Google advertisements that directed users toward imitation Ledger websites and applications. The phishing campaign has not been linked to the CryptoBilis hardware investigation. In its latest notice, Ledger said it was preparing additional measures intended to make unauthorized physical modifications harder to carry out.<\/p>\n The company did not announce a release date for those protections or provide details of any hardware redesign. For customers seeking guidance, Ledger directed inquiries to its official support website at support.ledger.com<\/a>.<\/p>\n Its security team said affected users would continue receiving direct communication as the investigation proceeds, while information about the incident can be submitted through its bounty program.<\/p>\n <\/p><\/div>\n\n\n
\n\n
Ledger confirms unauthorized implant in customer\u2019s wallet<\/strong><\/h2>\n
CryptoBilis halts all hardware wallet sales during investigation<\/strong><\/h2>\n
Security researcher reports hidden electronics behind Ledger screen<\/strong><\/h2>\n
On-chain researchers estimate millions in suspected thefts<\/strong><\/h2>\n
Ledger urges users to protect recovery phrases<\/strong><\/h2>\n