Ledger Confirms Implant in Wallet; Nearly $100 Million in Suspected Stolen Crypto Traced
Hardware implant found in one Ledger device as thefts mount
Ledger has confirmed that an unauthorized hardware implant was discovered inside one customer's cryptocurrency wallet. The finding came as independent investigators traced roughly $93.2 million in suspected stolen digital assets linked to the same incident.
The investigation began after customers reported losing funds after purchasing Ledger devices from CryptoBilis, an authorized reseller based in Southeast Asia. On Oct. 10, Ledger stated it had found no indication that its own security infrastructure, systems or services had been compromised. The company has not disclosed how many devices were modified or confirmed that the implant caused all reported losses.
What the company says about its authenticity check
Ledger's Genuine Check tool is designed to verify that a device's secure element — a tamper-resistant chip that protects private keys — is authentic. However, Ledger's own threat model documentation states that the check cannot detect unauthorized physical modifications, such as spying implants, if the secure element itself remains untouched and passes authentication.
In its Oct. 10 statement, Ledger said CryptoBilis had suspended sales of all hardware wallet inventory pending the investigation's conclusion. The company is contacting affected users, coordinating with authorities and developing enhanced anti-tampering protections. It has advised customers who purchased from CryptoBilis not to initialize unused wallets. Those who have already set up their devices should transfer holdings to a trusted wallet using a newly generated recovery phrase, since a recovery phrase displayed on a compromised device should be treated as exposed.
How the implant works
Research by Tibane Labs, led by former Mt. Gox chief executive Mark Karpelès, has documented three generations of implants in Ledger Nano X devices. The devices are designed to intercept the 24-word recovery phrase — the credential that lets a user restore access to their cryptocurrency holdings.
During setup, a Ledger device generates the recovery phrase inside its secure chip. The words must then pass through the display circuitry to appear on screen. Tibane Labs found that modified devices contained extra microcontrollers capable of reading that display data, reconstructing the recovery words, and sending them out via cellular modems with SIM cards built in.
Early versions used visible wiring and smaller replacement batteries. A later version examined in September hid a custom circuit board, an LTE modem, an antenna, and components with removed identifying marks under the screen, while preserving the original battery. That design could appear normal even after the casing was opened.
Tibane's specimens were purchased through Japanese marketplaces, not from CryptoBilis. The report does not establish that the reseller-linked thefts used the same implant design, and Ledger has not publicly described the device it found.
Loss estimates exceed $90 million
Two separate investigations produced overlapping but distinct loss figures. Galaxy Digital research executive Alex Thorn reported on Oct. 9 that approximately $91 million was moved across 477 addresses on Bitcoin, Ethereum-related networks and Tron. His analysis attributed $64.5 million of that total to Tron — including about 64.3 million USDT — with another $17.7 million in Bitcoin and $8.8 million on Ethereum and related networks.
Blockchain analytics firm Bitquery, in an update published Oct. 11, counted approximately $93.2 million in suspected thefts from 315 wallets across six blockchains. The two estimates use different address sets and methods; neither counts the number of tampered devices.
Bitquery identified transaction patterns suggesting the attackers gained control of multiple wallets before executing a coordinated withdrawal on Oct. 9. The firm found that 25 Tron wallets signed the same token approval within three seconds, allowing about $29 million in USDT to be withdrawn almost instantly. Small test transactions over roughly two weeks before the main thefts suggested the attackers began preparations well before users noticed missing funds.
In its Oct. 11 update, Bitquery estimated that Tether had frozen approximately $10 million in stolen USDT. It also identified $5.35 million in USDC that issuer Circle could potentially freeze after some funds moved through Tornado Cash and Zcash.
Supply-chain concerns remain open
CryptoQuant analyst Darkfost suggested examining other regional resellers for possible supply-chain exposure, but acknowledged the concern was speculative and unsupported by confirmed evidence at this time.
Why this matters for wallet users
The incident highlights a gap between a hardware wallet's built-in authenticity verification and the risk of physical tampering before the device reaches the user. Even if a device passes Ledger's Genuine Check, a hidden implant can still capture the recovery phrase as it leaves the secure chip and passes through the display circuitry. Users who bought from the implicated reseller are being advised to stop using those devices for active wallets and to move funds to new wallets generated on trusted hardware.
What happens next
Ledger said it is working on enhanced anti-tampering protections and continues to coordinate with authorities. No timeline for a fix or for the full scope of the investigation has been announced.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.