Ledger said on Oct. 11 that it found an "unauthorized hardware implant" inside at least one hardware wallet linked to the Southeast Asia theft case involving reseller CryptoBilis. It is the first time the company has formally confirmed physical tampering in an affected device.
Separately, blockchain analytics firm Bitquery said its latest tracing put suspected stolen assets at about $93.2 million across 315 wallets spanning Bitcoin, Ethereum, Tron, BNB Chain and Polygon. Ledger has not confirmed that total, and the figure remains a third-party on-chain estimate.
Ledger says the device itself was altered
The latest development moves the case beyond suspicion. Ledger said an extra unauthorized hardware component was found inside one affected user's device. The company said it is contacting other potentially affected users and working with law enforcement and security teams on the investigation.
Ledger also said it has found no evidence that its own security infrastructure, systems or services were compromised. Based on its current assessment, the case points more to supply-chain or physical device tampering than to a remote breach of Ledger servers, firmware or the Secure Element security chip.
Tibane Labs describes how the implant worked
Tibane Labs published a technical teardown of an implanted Ledger Nano X and described an attack that did not try to break the Secure Element itself. Instead, the attacker added a miniature circuit board inside a genuine Ledger device and tapped the data lines between the Secure Element and the OLED screen.
During first-time setup, the wallet displays the 24-word recovery phrase on screen. According to the research, the implant could read the pixel data sent to the display, identify the 24 English words, and then transmit the phrase to the attacker through its own LTE mobile module, SIM card and antenna. Once the attacker had the full recovery phrase, the same wallet could be restored on another device without needing access to the victim's Ledger again.
Genuine Check may still pass
Tibane Labs said one of the hardest parts of this attack is that the modified device may still be a real Ledger. Because the implant does not alter the Secure Element, the original chip can still authenticate itself to Ledger Live as genuine.
That means a user could receive a legitimate Ledger Nano X and still see a normal Genuine Check result, even though extra surveillance hardware had been soldered inside. Tibane Labs said this is different from the usual case of buying a fake Ledger. The risk here is a real device that was modified somewhere in the supply chain.
Researchers say the implant evolved through at least three generations
Tibane Labs said the implants were not one-off rough modifications. Researchers said they have identified at least three generations of implant design.
The earliest version used extensive hand-soldered wiring and even required shrinking the original Ledger battery to make room for the implant board. Newer versions used custom flex PCBs shaped to match Ledger Nano X factory test points, along with a dedicated mobile network chip, eSIM and custom antenna.
Some components were painted to resemble the color of Ledger's original motherboard, and chip markings were removed. Tibane Labs said the design looked less like an individual hacker experiment and more like an operation with budget, engineering capability and an apparent intent to manufacture at scale.
Bitquery expands the suspected loss estimate
Bitquery said that as of Oct. 11 it had traced about $93.2 million in suspected stolen assets across 315 wallets on six blockchains. Assets in the Tron ecosystem still made up the largest share, while Bitcoin and Ethereum also saw substantial transfers.
The firm also tracked some of the funds moving through Tornado Cash, Zcash and other exchange routes. In its latest update, Bitquery said another 1,736 ETH had entered Tornado Cash and Zcash-related flows. Some assets were later converted into USDC, and Bitquery said about $5.35 million in USDC sat at addresses that Circle might still be able to freeze.
Ledger has not confirmed that all 315 wallets belong to the same incident, and it has not formally verified the $93.2 million total.
Tether had already frozen about $10 million in USDT
The case has also drawn in stablecoin issuers. Earlier on-chain investigation showed that Tether froze about $10 million in USDT tied to addresses linked to the suspected theft.
The episode highlights a difference between centralized stablecoins and native crypto assets such as BTC and ETH. Issuers of USDT and USDC can blacklist and freeze tokens at specific addresses. Bitcoin or native ETH, once controlled and moved by an attacker, are usually much harder to recover.
CryptoBilis halts all hardware wallet sales
When the case first surfaced, Ledger asked CryptoBilis to suspend sales and shipments of Ledger products. Ledger now says CryptoBilis has gone further and stopped selling all hardware wallet inventory until the investigation becomes clearer.
The reseller had been one of Ledger's official sales channels in Malaysia, Indonesia and the Philippines, which is why the development has drawn close attention. If the implants are ultimately shown to have entered the official retail supply chain, the implications would extend beyond Ledger to the broader trust model behind authorized hardware wallet distribution.
Ledger also said that the asset-drain cases it has confirmed so far all involved devices sold by CryptoBilis, while no similar issue has been found in Ledger's own direct-sales channel. That narrows the focus to a specific supply chain rather than Ledger's global product line.
Ledger's guidance for recent buyers
Ledger said it remains on high alert for users who recently bought devices from CryptoBilis. If a device has not yet been set up, the company said it should not be initialized. If setup is already complete and assets have been deposited, users should consider moving funds to a trusted new hardware wallet and must create a new recovery phrase.
Replacing only the hardware while keeping the old 24-word recovery phrase does not solve the problem. If the phrase was ever displayed on the screen of an implanted device, Ledger said it should be treated as potentially exposed.