TL;DR
Get home office essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Ledger says all reports it investigated of unexpected cryptocurrency drains involved devices sold through Malaysia-based reseller CryptoBilis, and confirmed an unauthorized hardware implant in at least one device. Researchers have described concealed circuitry in Ledger Nano X devices, but Ledger has not publicly confirmed the specific model or how the devices were tampered with.
Ledger has confirmed that at least one device linked to reports of stolen cryptocurrency contained an unauthorized hardware implant, and says all fund-drain reports it investigated involved wallets sold through Malaysia-based reseller CryptoBilis. The company described the affected volume as “limited,” but has not said how or when the devices were altered.
Ledger said it began investigating customer reports of cryptocurrency losses on October 9 and asked CryptoBilis to stop selling and shipping Ledger devices. The next day, the company confirmed that one impacted customer’s device contained an unauthorized implant. In a later update, Ledger said all user reports of unexpected fund drains it had reviewed were tied to devices sold through the reseller. It has not published a total number of affected customers or devices.
Ledger is contacting affected users and says it is working with authorities to identify the person responsible. Its guidance is that customers who bought a device from CryptoBilis and have not set it up should not begin setup. Customers who already used one should consider transferring their assets to a new Ledger signer using a new seed phrase. That is the company’s precautionary advice; Ledger has not stated that every device sold through CryptoBilis was implanted.
Security researchers and former Mt. Gox CEO Mark Karpelès have described suspected implants in Ledger Nano X devices. Researchers at Tibane Labs reported examining two variants, with circuitry concealed inside the wallet and components for cellular connectivity. These findings provide technical detail about specimens researchers examined, but Ledger has not publicly confirmed that the affected devices were Nano X models or verified every detail of the researchers’ analysis.
A Supply-Chain Risk for Wallet Owners
The reports highlight a risk distinct from a remote software attack: a device intended to protect cryptocurrency can be altered before it reaches its buyer. Hardware wallets hold the private keys used to control assets and approve transactions. If a compromised device exposes the seed phrase used to restore a wallet, an attacker may be able to access the associated funds. The precise method and scope of these cases remain under investigation.
The incident also shows why buyers’ source of purchase matters. Ledger’s standard Genuine Check can test aspects of a device’s authenticity, but the company says it cannot detect added hardware implants when the original Secure Element remains intact. That limits what a buyer can infer from a successful check: it is not a guarantee that no unauthorized component has been added.
Ledger has advised customers to avoid unauthorized resellers, and it reminded authorized sellers to obtain inventory through approved channels and not restock returned products. The company’s warning is relevant to people buying security devices through marketplaces or secondary sellers, where product history may be harder to establish. There is currently no indication in the report that other Ledger resellers are distributing compromised wallets.
As an affiliate, we earn on qualifying purchases.
How Investigators Found the Implants
Ledger devices are physical wallets designed to keep private keys protected and authorize cryptocurrency transactions. The company’s investigation followed customer reports of funds disappearing from wallets associated with devices bought through CryptoBilis, described in the report as a major Malaysia-based retailer serving Southeast Asia. Ledger’s request that the reseller stop shipments came before its public confirmation of an implant.
Karpelès shared an image of an implant he said was found in a Ledger Nano X and described it as concealed behind the screen. Tibane Labs later said it examined two device variants purchased through different sellers in Japan, with listings indicating shipment from Malaysia. The researchers reported that one implant used a smaller replacement battery to make room for additional circuitry, while another fit beneath the display. They also described an eSIM and LTE components in the specimens.
Researchers said antenna wiring was a visible sign in the devices they examined. Tibane Labs characterized one circuit board as professionally manufactured rather than a one-off hand-built component. These observations concern the samples in the researchers’ possession; the supplied reporting does not establish who made the devices, where the tampering took place, or whether the same design was used in every affected wallet.
““Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant.””
— Ledger
portable crypto hardware wallet lockbox
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Scope and Tampering Method Remain Open
Ledger has not disclosed the number of affected devices or customers, identified the specific device model, or explained how and when the hardware was altered. It has confirmed an implant in at least one impacted device and linked all the fund-drain reports it reviewed to CryptoBilis sales, but that does not establish that every device from the reseller was compromised.
The identity of the person or group responsible is also unknown. Researchers’ accounts of Nano X implants, cellular components and possible ways to capture sensitive information are based on devices they examined. Ledger has not publicly confirmed those technical details or said that the specimens shown by researchers are the same devices involved in each customer report. No other reseller has been identified in the supplied reporting as a source of compromised devices.
As an affiliate, we earn on qualifying purchases.
Customer Guidance and Investigation
Ledger says it is contacting impacted users and cooperating with authorities as its investigation continues. Customers who bought through CryptoBilis should follow the company’s stated precautions: do not set up an unused device, and consider moving assets from a device already set up to a new signer with a new seed. Anyone taking action should use trusted, official guidance and take care to keep recovery information private.
Further updates will need to clarify how many devices were affected, which models were involved and how the implants were installed and operated. Ledger has also urged its authorized sellers to use approved supply channels and avoid reselling returned stock. Until the company or investigators release more findings, the source and full reach of the tampering remain unsettled.
As an affiliate, we earn on qualifying purchases.
Key Questions
What has Ledger confirmed?
Ledger confirmed that at least one impacted device contained an unauthorized hardware implant. It also said all fund-drain reports it investigated were linked to devices sold through CryptoBilis, and described the affected volume as limited.
Does this mean every CryptoBilis device was compromised?
No. Ledger has not said that every device sold through the reseller was altered. It has not published the total number of affected devices or customers.
What should CryptoBilis customers do?
Ledger advises customers who have not set up a device from the reseller not to begin setup. If they have already set it up, Ledger says to consider transferring assets to a new signer using a new seed phrase.
Can Ledger’s Genuine Check detect an implant?
Ledger says its Genuine Check cannot detect added implants when the device’s original Secure Element remains intact. A successful check therefore does not rule out every form of hardware tampering.
Has Ledger confirmed the implants were in Nano X wallets?
No. Researchers and Karpelès have described implants in Nano X devices, but Ledger has not publicly identified the model involved in its confirmed case or verified all the researchers’ technical findings.
Source: hn
Columbus Day / Indigenous Peoples' Day Picks
long weekend sales
As an affiliate, we earn on qualifying purchases.
