Ledger confirms spy chip implant in CryptoBilis-sold wallets

Ledger confirmed on 10 October 2026 that at least one affected user's device contained an unauthorised hardware implant, after investigating reports of cryptocurrency losses on wallets purchased through CryptoBilis, a Malaysia-based reseller operating across Southeast Asia. The company linked all user reports of unexpected fund drains to devices sold through CryptoBilis and described the affected volume as limited.cryptobriefing.com+1

The confirmation matters because hardware wallets are meant to store the private keys controlling cryptocurrency assets offline, out of reach of remote attackers. Ledger had already asked CryptoBilis on 9 October 2026 to stop selling and shipping its devices. The company said it was working with authorities to identify the perpetrator, and no other Ledger resellers are currently indicated as shipping compromised wallets.

What Ledger confirmed

Ledger warned users who bought a device from this reseller not to set it up if they had not already done so, and advised those who had set up their device to move assets to a new Ledger signer with a new seed. The company also reminded authorised resellers and distributors to source products only through authorised channels and to avoid restocking returned products.

Ledger's own 'Genuine Check' mechanism, designed to verify device authenticity, explicitly cannot detect added implants when the device's original Secure Element remains intact. This means a compromised wallet can pass the company's own verification, leaving buyers without a reliable way to confirm their device is untampered before using it. Researcher Mark Karpelès showed a picture of the implant inside a Ledger X, describing it as quite an evolution from previous versions that used manually soldered wires. The implant was concealed behind the screen, though its antenna cable would have indicated something was wrong. Karpelès said the malicious hardware captured the device's display output and button presses to identify the seed phrase, then transmitted it to the attacker over an LTE connection using an eSIM.

How the implant worked

Tibane Labs, a cryptocurrency research and development studio, confirmed Karpelès' finding and identified two implant versions for the Ledger X. In one variant, the threat actor made room for the malicious circuitry by replacing the original battery with a smaller one powering both the implant and the device. The researchers found an ST STM32G431KBU6 microcontroller, an eSIM measuring 2×2 mm, and a shielded LTE module that sends the captured words out.

The second variant, matching Karpelès' description, ran on the original battery and fit into the space normally occupied by the foam padding under the OLED display. In both cases, the antenna wire was the tell-tale sign. Tibane Labs warned that one specimen used a designed, panelised flex PCB, the kind ordered from a board house rather than a hand-built one-off, suggesting professional manufacturing.

Losses and frozen funds

A post on X claimed the attackers bought the reseller outright, had it sign a non-disclosure agreement, and stole over $80 million by slipping spy chips into the wallets. Ledger has not confirmed that account of the reseller purchase and the NDA. Researchers have also shown the implant in Ledger X devices since 16 September, noting tampered devices were available for nearly half the price of the original hardware.

CryptoBilis serves customers in Malaysia, Indonesia, and the Philippines. Ledger's position is that the problem is confined to the reseller channel, with no evidence that its core systems or products sold directly were affected. The community's trust in the reseller network has been shaken, with many calling for its dismantling. The next open questions are how many devices carried implants and whether more stolen funds get frozen.