Ledger confirms a spy implant in resold hardware wallets
Devices sold through reseller CryptoBilis carried hidden circuitry that, researchers say, captured the seed phrase and sent it out over LTE.
2 minThreat Intelligence
Ledger has confirmed that some hardware wallets distributed through CryptoBilis, a Malaysia-based reseller operating across Southeast Asia, were fitted with a hardware implant and used to drain users' funds. The company opened an investigation on 9 October after users reported losses and asked the reseller to stop selling and shipping its devices. A day later it confirmed an unauthorised implant in at least one affected user's wallet, and on 11 October it said every report of unexpected drains it had received was linked to devices sold by CryptoBilis, describing the volume as limited.
Ledger's advice is short. Anyone who bought from that reseller and has not set the device up should not start. Anyone who has should consider moving assets to a new Ledger signer with a new seed.
What the implant does
Independent researchers have opened affected Nano X units. Mark Karpelès showed an implant concealed behind the screen that captured the display output and button presses to work out the seed phrase, then transmitted it over LTE using an eSIM. Tibane Labs found two variants, one bought on Amazon Japan from a China-based seller shipping from Malaysia and one from Yahoo! Auctions Japan.
- First variant: the original battery replaced by a smaller one that powers both the wallet and the implant, an STM32G431KBU6 microcontroller, a 2×2 mm eSIM and a shielded LTE module.
- Second variant: runs on the original battery, sits where the foam under the OLED display normally goes, and has the part markings scraped off the chips.
- In both, the giveaway was the antenna wire.
Tibane's most telling observation is about production: the circuit was a designed, panelised flex board of the kind ordered from a board house, not a hand-built one-off. That points to an operation set up to repeat, not an opportunistic tamper.
Ledger is telling customers to avoid unauthorised resellers, and its authorised distributors to source only through official channels and not to restock returned products. There is no sign so far that other resellers shipped compromised units.
Retold from BleepingComputer. This is a summary in our own words; follow the link for the original reporting.