Ledger hidden implant found in Ledger X sold by Malaysia reseller

The short version

Ledger has confirmed an unauthorized hardware modification in at least one Ledger X device sold through CryptoBilis, a reseller in Southeast Asia.
Customers who bought wallets from CryptoBilis are warned not to set up the device yet; if already set up, consider moving assets to a new Ledger signer with a fresh seed.
Ledger is contacting impacted users and working with authorities; the scope is described as limited so far.
Researchers describe the implant as capable of reading display output and button presses to identify seed phrases and transmitting them over LTE via an eSIM.

Quick read · 2 min

Ledger says some Ledger X wallets sold through a Southeast Asian reseller were modified with a hidden hardware implant designed to capture seed phrases and transmit them over cellular links. The company says the issue is limited to those specific orders from CryptoBilis, and customers should avoid setting up affected devices until authenticated.

For everyday users, the takeaway is simple: buy hardware wallets only from Ledger’s official channels, and be cautious if your device came from a non-Ledger reseller. If you already set up a questionable device, consider moving to a new seed on a new device and avoid entering sensitive data on the compromised unit.

What happens next: Ledger is working with authorities; if you’re affected, you’ll likely hear from Ledger directly with guidance.

Ledger has confirmed that some Ledger X hardware wallets distributed through CryptoBilis, a Southeast Asia reseller, were tampered with by an unauthorized hardware modification. The company began investigating reports of crypto losses and asked CryptoBilis to stop selling and shipping Ledger devices. By Oct 9, Ledger disclosed that at least one device contained the implant, though the full scope remains unclear and Ledger calls the affected volume limited.

Researchers have demonstrated variants of the implant inside Ledger X devices. The attackers allegedly used the hidden circuitry to capture what appears on the device’s screen and any button presses to guess the seed phrase, then transmit that data over a cellular connection using an eSIM. In some cases, the implant sits behind the display; in others, it replaces the device battery to power the covert electronics.

Ledger notes the compromised devices did not come through Ledger’s official channels. It urges customers who bought wallets from CryptoBilis to avoid setting up those units. If a device has already been used, Ledger recommends moving assets to a new Ledger signer with a fresh seed phrase. The company is coordinating with authorities to identify the attacker and pursue justice.

Ledger says the issue appears limited to wallets tied to CryptoBilis; other Ledger wallets from authorized channels have not been indicated as affected at this time. Researchers, including Tibane Labs, have provided details about the implants, including a small eSIM and a shielded LTE module used to send data. Mark Karpelès, a crypto veteran, has discussed the implant publicly, noting its sophistication and the challenges it poses for detection.

Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis. As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices.…

— Ledger Support (@Ledger_Support) October 9, 2026

What this means for everyday users

For most people, this highlights supply-chain risk in crypto hardware. A wallet is only as secure as the place it comes from. If your Ledger wallet came from CryptoBilis, treat it as potentially compromised until you verify its authenticity and consider replacing it.

Practically, if you bought a Ledger wallet from CryptoBilis, do not set it up yet. If you already set up a wallet from that seller, think about transferring your assets to a new Ledger signer with a new seed phrase on a device bought through Ledger’s official channels.

hidden chip embedded in electronics circuit board

How the attack was described by researchers

Two implant variants were observed. One sits behind the OLED display with an antenna along the device edge; the other replaces the battery to power the covert components. Both aim to read the screen and button presses to extract the seed phrase and then send it to the attacker via LTE using an eSIM. The attacker’s goal is to harvest the seed phrase, which controls access to the stored crypto assets.

Ledger’s next steps

Ledger is coordinating with authorities to identify the actor and halt sales of affected devices. It’s asking customers who suspect a compromised device to contact Ledger and avoid setting up the unit until it has been authenticated through official channels.

What you can do now

– If you bought a Ledger device from CryptoBilis: do not set it up yet. – If you already set up a device from CryptoBilis, move assets to a new Ledger signer with a fresh seed. – Buy only from Ledger’s official channels or authorized partners. – Use Ledger’s Genuine Check to verify authenticity, but remember it cannot detect an implanted device if the Secure Element remains intact. – Monitor wallet activity for unusual transactions and report them to the appropriate authorities if needed.

Quick answers

What happened?

Ledger confirmed an unauthorized hardware modification was found in some Ledger X wallets sold through CryptoBilis, linked to crypto thefts.

What should I do if I bought one?

Do not set up the device yet; if already set up, move assets to a new Ledger signer with a fresh seed phrase.

Is every Ledger device at risk?

Ledger says the issue appears limited to devices tied to CryptoBilis; other Ledger wallets from authorized channels aren’t indicated as affected at this time.

You're reading the quick version.