Ledger has confirmed that at least one hardware wallet distributed through CryptoBilis, a Malaysia-based reseller operating across Southeast Asia, contained an unauthorized hardware implant. Users who bought devices there reported losing cryptocurrency, and Ledger says all unexpected fund-drain reports it has received are tied to devices sold by that reseller, which it describes as a “limited” volume. Ledger asked CryptoBilis to stop selling and shipping its devices on October 9 and is working with authorities. It is still unclear how or when the devices were tampered with.
Independent researchers have published teardowns. Mark Karpelès showed an implant in a Ledger Nano X hidden behind the screen that, he says, captured the display output and button presses to recover the seed phrase and sent it to the attacker over LTE using an eSIM. Tibane Labs examined two variants, one bought through a China-based seller on Amazon Japan and one on Yahoo! Auctions Japan, both shipped from Malaysia. In one the attacker swapped in a smaller battery to make room; in the other the implant sits where the foam padding under the OLED normally is. Tibane describes a professionally made flex PCB, not a hand-built one-off. Researchers say tampered units were being sold for nearly half the original price, and have shown the implant in Ledger X devices since September 16.
How to check if you’re affected
Affected devices are Ledger hardware wallets bought from CryptoBilis, and, per the researchers’ findings, units bought from third-party marketplace sellers shipped from Malaysia. Ledger’s guidance: if you have not set the device up yet, do not start; if you have, move your assets to a new Ledger signer with a new seed phrase. Do not reuse the old seed. Buy only from Ledger’s own store or its authorized resellers. Ledger has not said which models are affected beyond reports about the Nano X, so treat any Ledger bought from an unofficial channel as suspect. Both research teams point to an antenna wire visible along the top edge or battery as the tell-tale sign, but the safe response is to migrate funds rather than rely on a visual inspection.