Ledger hidden implant found in Ledger X sold by Malaysia reseller

The trouble surfaced in Southeast Asia. Customers who bought Ledger wallets from CryptoBilis, a large Malaysia-based seller of hardware wallets, reported that their crypto had vanished. On October 9, Ledger said it had opened an investigation and told CryptoBilis to stop selling and shipping its devices.

The next day, Ledger confirmed that at least one affected customer’s device contained an unauthorized hardware implant. It later said every report of unexpected fund drains it had received was tied to devices sold through CryptoBilis, and described the number affected as limited.

Researchers had been showing off implanted Ledger X wallets since September 16. Those tampered units were being sold for nearly half the normal price, a detail that, in hindsight, was a warning sign. The cheap price drew buyers who thought they had found a bargain on a well-known brand.

Your recovery phrase, often called a seed phrase, is a list of words that can rebuild your wallet on any device. Anyone who has it can take your crypto. The implant was designed to grab exactly that.

Mark Karpelès, the former CEO of the collapsed Mt. Gox exchange, shared a photo of one implant tucked behind the wallet’s screen. He said it recorded what the display showed and which buttons were pressed during setup, worked out the seed phrase and then sent it to the attacker over an LTE mobile data connection using an eSIM, a digital SIM card. His device came from a Chinese seller on a well-known shopping platform and shipped from Malaysia.

Tibane Labs, a crypto research studio, took apart two different versions:

• The first swapped the wallet’s battery for a smaller one to make room, then used that battery to power both the wallet and the spy board. It held a small processor, an eSIM about 2mm square and a shielded LTE module.
• The second was more advanced. It used the original battery and fit into the space where foam padding normally sits under the screen. The part numbers on its chips had been scraped off.

One device came from Amazon Japan through a seller based in China that shipped from Malaysia, and the other from Yahoo Auctions in Japan. The researchers said the circuit board was professionally designed and ordered from a factory, not a hand-soldered one-off. In both versions, the giveaway was an antenna wire running inside the case.

Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis. As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices.…

— Ledger Support (@Ledger_Support) October 9, 2026

Ledger, which is based in Paris, called it one of the most sophisticated attacks the crypto industry has seen. The company says a highly organized criminal group bought genuine Ledger devices, fitted the implants and slipped them back into the supply chain through resellers. The group built its own servers to collect seed phrases, plus systems to drain and launder the money, and then hit many wallets in one coordinated strike.

Ledger stresses that its own chip, operating system and servers weren’t compromised; the attack happened after the devices left its control. In what it calls its largest investigation so far, it sent staff to other markets, including Europe, to check other supply chains, and says the devices it screened were clean. Authorized resellers and distributors in Southeast Asia and Hong Kong have paused sales, and Ledger says it’s working with police to trace the stolen funds.

The most worrying detail is that Ledger’s own authenticity test can’t catch this. Its Genuine Check confirms the device’s secure chip is real, and in these wallets it was. So a tampered wallet can pass the check while still spying on you.

Here’s what Ledger and the researchers advise:

• Bought from CryptoBilis and not set up yet? Don’t set it up.
• Already using one from that seller? Move your funds to a new Ledger device with a brand-new seed phrase, bought from an official channel.
• Buy only from the maker or an authorized reseller. Avoid marketplace sellers, auction sites and suspiciously cheap listings, even on big platforms.
• Inspect the box and device. Signs of opening, an unusually low price or an unfamiliar seller are reasons to return it.

Ledger has also told its authorized sellers to source products only through approved channels and not to put returned units back on the shelf.