Ledger hardware implant has been confirmed by the company. At least one device tied to recent user losses contained an unauthorized implant. In plain terms, the hardware was physically altered between the factory and the buyer.
Every confirmed case so far involves products distributed by CryptoBilis. That reseller operates in Indonesia, Malaysia, and the Philippines.
Why the Ledger hardware implant confirmation matters
In an October 10 statement, Ledger Support said one impacted user’s device contained an unauthorized hardware implant. A day later, the company said all confirmed cases relate to the October 9 draining incident. They involve devices sold through CryptoBilis.
Ledger says its internal systems and direct sales channels were not affected. The physical tampering is isolated to the batch the reseller distributed. This confirmation is the first concrete evidence behind earlier supply-chain tampering speculation.
The check that watches the chip, not the case
One detail in Ledger’s security documentation explains why this is awkward for owners. Genuine Check verifies the secure element’s authenticity. That is the chip that generates and stores keys. However, it cannot detect unauthorized physical modification. A spying implant would remain undetected if the secure element stays intact.
The check guards the component, not the board around it. An attacker who leaves the secure element alone and adds hardware beside it stays outside the verifying part.
What researchers found inside modified devices
Tibane Labs examined suspicious Ledger Nano X devices. It worked with former Mt. Gox CEO Mark Karpelès. The lab documented three generations of implants designed to intercept recovery phrases.
According to its research, the implants monitor electronic signals. Specifically, they watch signals sent between the secure element and the display. The modified devices contained extra microcontrollers that could read screen data. They could rebuild recovery words and transmit them through cellular modems.
A more advanced version examined in September held a custom circuit board under the screen. It included an LTE modem and an antenna. Components had their identifying markings removed.
One limit matters here. Tibane’s two specimens came from Japanese marketplaces, not CryptoBilis. Its report does not establish the design used in the reseller-linked thefts. Ledger has not publicly described the implant it found.
Three loss estimates, three different numbers
Losses are still being counted, and the counts disagree. Third-party on-chain researchers put the total between $86 million and $93 million. That covers more than 300 wallets on Bitcoin, Ethereum, and Tron.
Bitquery’s October 11 update counted about $93.2 million in suspected thefts. That covered 315 wallets across six blockchains.
Alex Thorn of Galaxy Digital reported about $91 million across 477 addresses on October 9. That included $64.5 million on Tron, of which roughly $64.3 million was USDT. He put Bitcoin at $17.7 million, about 213 BTC. Ethereum and related networks accounted for $8.8 million.
The two estimates use different address sets and methods. Neither counts the number of tampered devices. Therefore, neither is a headcount of affected owners.
Bitquery’s analysis adds a timeline worth knowing. It found that 25 Tron wallets signed the same token approval within three seconds. That allowed about $29 million in USDT to be withdrawn in moments. Small test transactions ran for roughly two weeks before the larger thefts.
Tether has frozen about $10 million in stolen USDT. Bitquery also identified $5.35 million in USDC that Circle could freeze. Those funds moved through Tornado Cash and Zcash.
What Ledger is telling users now
The guidance is short and specific. First, do not initialize unused devices. Second, if a device is already set up, move to a new seed on a device from Ledger.
Ledger also told distributors to source products exclusively through authorized channels. It prohibited the restocking of returned products. The company repeated that it will never call or ask for a 24-word recovery phrase.
Tibane Labs warned that a recovery phrase displayed on a compromised device should be treated as exposed. Therefore, the advice points to a new seed rather than a new screen.
CryptoBilis has suspended sales of all hardware wallet inventory. This will last until the investigation concludes. Ledger says it is cooperating with relevant authorities.
Binance co-founder Changpeng Zhao alleged that attackers bought the reseller. He said they made it sign a non-disclosure agreement. That claim has not been independently verified.
What remains open
The part owners would most like answered remains unclear. Specifically, how many devices were modified? Which models? Did the implant cause all reported losses? Ledger has not said.
For scale, a July 2026 flaw in Coldcard’s firmware let attackers drain an estimated $100 million to $130 million. That is a larger figure than the top end of this week’s estimates.
