Ledger confirms spy-chip implant behind crypto wallet thefts

Ledger has confirmed that some of its devices, distributed through the Southeast Asian reseller CryptoBilis, were fitted with a hardware implant that drained users' cryptocurrency wallets.

CryptoBilis is a major Malaysia-based hardware-wallet retailer operating across the region. After customers reported missing funds, Ledger opened an investigation on October 9 and asked the reseller to stop selling and shipping its devices. The next day the company confirmed hardware tampering on at least one unit, while noting it was still unclear exactly how or when the devices had been altered.

"Ledger can confirm that one of the impacted users' devices contained an unauthorized hardware implant," the company said, adding that it was contacting victims and working with authorities. It advised buyers who purchased from the reseller not to begin setup, and those who already had to move their assets to a new Ledger signer with a fresh seed. A later update said every confirmed theft was tied to CryptoBilis, and described the affected volume as "limited."

What researchers found

Mark Karpelès, the former head of the notorious Mt. Gox exchange, posted a photo of the implant inside a Ledger X and called it "quite an evolution" over earlier versions with hand-soldered wires. He said the chip hid behind the screen, captured the display output and button presses to recover the seed phrase, and sent it to the attacker over LTE using a built-in eSIM. The only giveaway was the antenna cable.

Studio Tibane Labs confirmed the finding and documented two implant variants. In one device the attacker freed up space by swapping the stock battery for a smaller one; beneath it sat an ST STM32G431KBU6 microcontroller, a tiny 2×2 mm eSIM, and a shielded LTE module. The second, more advanced variant ran on the original battery and tucked into the foam padding space under the OLED display; its chip markings had been scraped off to hide the part numbers. The researchers stressed this was a designed, panelised flex PCB from a board house — not a hand-built one-off.

Trust shaken

Ledger warns that its Genuine Check feature cannot detect an added implant as long as the original Secure Element stays intact. The company is urging buyers to avoid unauthorized resellers and reminding distributors not to restock returned products. There is no sign other resellers shipped compromised wallets, but the community's trust in the reseller network has taken a hit, with many now calling for it to be dismantled.

Source: Bleeping Computer