Ledger has confirmed that an unauthorized hardware implant was found in a customer’s device purchased through CryptoBilis, a reseller serving Indonesia, Malaysia and the Philippines. The finding raises concerns about whether the company’s device authenticity checks can detect physical modifications that leave its security chip intact.
The disclosure follows reports of cryptocurrency wallets being drained after customers purchased Ledger devices through the reseller. Ledger said the confirmed cases linked to the October 9 incident involved devices sold through CryptoBilis, while its internal systems and direct sales channels remained unaffected.
CryptoBilis suspended sales of its hardware-wallet inventory while the investigation continues. Ledger has described the number of affected devices as limited but has not published a complete count of compromised units or a forensic account of the implant found in the customer’s device.
The incident exposes a documented limitation in Ledger’s Genuine Check. According to the company’s security documentation, the check authenticates the Secure Element, the chip responsible for protecting sensitive wallet operations. It cannot detect every unauthorized physical modification, including spying implants, when the original Secure Element remains intact.
A modified device could therefore pass an authenticity check without being free of malicious electronics elsewhere in its hardware. Genuine Check is designed to establish that a device contains an authentic Ledger security chip, not to certify that every component has remained untouched throughout manufacturing and distribution.
Ledger advised customers who bought devices through CryptoBilis in the preceding 90 days not to initialize unused units. Customers who had already set up their devices were advised to consider moving their assets to a new device using a newly generated recovery phrase.
Independent blockchain investigations have estimated that the associated wave of wallet-draining incidents involved tens of millions of dollars in cryptocurrency. Bitquery estimated losses of $93.2 million across 315 wallets on six blockchain networks. YFarmX put the figure at $94.5 million, drawing on a broader set of 521 sending addresses. Other investigators reported lower totals because they tracked different groups of addresses.
The estimates do not establish that every theft resulted from the confirmed hardware implant. Blockchain records can show transfers and trace funds, but they do not by themselves prove how an attacker obtained a wallet’s recovery phrase or private-key access.
Researchers have documented related Ledger Nano X implants that monitor display signals to capture recovery words and use cellular hardware to transmit the information. However, the devices examined in those investigations were obtained separately from the CryptoBilis case. Ledger has not publicly disclosed enough forensic detail to establish whether the implant it confirmed used the same design.
The reseller’s position in Ledger’s approved distribution network has also drawn attention to supply-chain security. Public information has not established where the affected device was modified, who installed the implant or whether the alteration occurred before or after the device reached CryptoBilis.
Ledger said it was cooperating with relevant authorities as it investigated the incident and reviewed reseller controls and hardware protections.
Discover more from Aree Blog
Subscribe now to keep reading and get access to the full archive.
