Ledger Confirms an Implant in a Nano X Sold Through CryptoBilis, but Not That It Caused the Thefts
Security / news
Ledger Confirms an Implant in a Nano X Sold Through CryptoBilis, but Not That It Caused the Thefts
Ledger said on October 10 that one affected customer's wallet held an unauthorized hardware implant. It has not said how many devices are modified or how the losses happened.
A modified Ledger Nano X can, according to researchers at Tibane Labs, read the recovery words as they appear on the screen and send them over a cellular link to whoever built the device (the buyer must set up the wallet and write down a new phrase on the tampered unit). Ledger confirmed on October 10, 2026 that one affected customer's device contained "an unauthorized hardware implant", as reported by crypto.news.
Ledger has not established whether the implant caused the thefts it is investigating, how many wallets are affected, or how the part was installed. It did not disclose the model of the device in its statement. It also said it has "no indication that Ledger's security infrastructure, systems or services have been compromised."
If you bought a Ledger through CryptoBilis, do not set it up. If you already did, move the funds to a new device initialized with a new recovery phrase. Reusing the old phrase on a new wallet does not remove the exposure, Ledger said.
What was found inside the device
Tibane Labs analysed the devices, according to heise online, which reports that the original secure element chip was left untouched. The added part sits between that chip and the screen, intercepts the signal, recognises the letters of the seed phrase as they are drawn, and transmits them. Tibane Labs calls the technique "embedded Tempest".
Heise lists an added LTE modem, an eSIM module and a small antenna, all powered by the wallet's own battery. Because the secure element is not modified, a check of the chip's authenticity would pass.
| Generation | Build quality | Visible sign |
|---|---|---|
| First (Joe Grand's sample) | Battery swapped for a much smaller one | Wiring visible when the case is opened |
| Second | More professional, battery still replaced | Not stated |
| Third | Parts cut for series production, original battery kept | A small antenna wire |
The first sample was presented by the embedded-security specialist Joe Grand at the Hardwear.io conference in May, according to heise. Grand Idea Studio's project page carries slides revised May 29, 2026 and firmware labelled ARM Cortex-M0+. The page does not say when the implant was found.
The losses are estimates, and they disagree
Crypto.news reports Bitquery's estimate of $92.9 million lost across 311 wallets, and says Ledger has not confirmed it. Earlier on-chain estimates were above $72 million, and one researcher's figure exceeds $86 million. Heise puts the total at about $100 million in one passage and about $93 million across more than 300 wallets in another.
- Earlier on-chain estimate72 million USD
- Researcher estimate86 million USD
- Bitquery (311 wallets)92.9 million USD
Source: crypto.news and heise online, accessed 2026-10-13; none confirmed by Ledger
None of these numbers links a specific implanted device to a specific drained wallet. That link is the open question.
A timeline from May to October 10
- May 2026: Grand presents a manipulated Nano X at Hardwear.io, per heise.
- March 2026: former CryptoBilis executives say they handed over operational control, per crypto.news.
- October 9: reports of unauthorized transactions appear, and Mark Karpelès, the former Mt. Gox chief executive, publishes his examination of a Nano X from Malaysia that had extra electronics behind the display.
- October 10: Ledger confirms the implant in one customer's device, says it has contacted law enforcement, and says SEAL_911 is assisting.
CryptoBilis sells mainly in Southeast Asia from Malaysia, per heise, and crypto.news names Indonesia, Malaysia and the Philippines. Ledger asked it to halt Ledger sales, and CryptoBilis then suspended sales of all its hardware wallets until the investigation ends.
Heise also reports unverified screenshots suggesting the dealer changed hands in August to an owner named JiaMing. It calls that unconfirmed, and it conflicts with the March handover date given to crypto.news.
Not every modified unit came from that dealer
Heise says Tibane Labs documented a manipulated device bought through Amazon Japan from a Chinese seller, mailed from Malaysia. That route does not run through CryptoBilis, which is a reminder that a reseller ban does not cover every tampered unit.
Ledger said it is developing protections against physical tampering, with no release date. Ledger support will never ask for the 24-word recovery phrase. The next fixed point is Ledger's account of how many devices were altered, which it has not scheduled.
On The Terminal, related reporting: CISA's October 8 catalog additions and the Denmark CPR breach.
Sources
More in Security
- 01Ivanti Connect Secure Chain Gives Root on Patched Appliances, and One Link Still Has No FixVolexity says an actor it calls UTA0576 chained three flaws from October 3. Ivanti patched two on October 13 and has not scheduled the third beyond "the coming weeks".
- 02SonicWall SMA1000 CVSS 10.0 Flaw Draws 135 Attempts From Two IP AddressesPrevidian's telemetry comes from a single sensor, and SonicWall had not updated advisory SNWLID-2026-0017 to mention exploitation when The Hacker News reported on Oct. 12.
- 03Seven Nations Name Integrity Tech Behind Flax Typhoon Tools as FBI Seizes Seven DomainsAdvisory AA26-281A lists eight exploited CVEs dating to 2014, and five of them were added to CISA's KEV catalog only with its release.
- 04Citrix NetScaler Zero-Day Attack Copies nsconfig to a Public Web PathRapid7 traced exploitation of CVE-2026-88771 to Sept. 20, a week before Citrix shipped fixes, and CISA has since added a third NetScaler flaw to KEV.