Ledger wallet implant exposes a gap in its authenticity check

Ledger has confirmed an unauthorized hardware implant in one affected customer's wallet as independent investigators estimate $93.2 million in suspected cryptocurrency thefts.

In an Oct. 10 statement, the hardware wallet manufacturer said the discovery involved a device belonging to one of the affected users. It added that CryptoBilis, an authorized reseller operating in Southeast Asia, had suspended sales of all hardware wallet inventory pending the investigation's conclusion.

The investigation began after customers reported losing cryptocurrency after buying Ledger devices from the reseller. Ledger has not said how many devices were modified or established that the implant caused all the reported losses.

Ledger said it had found no indication that its security infrastructure, systems or services had been compromised.

Why an implanted wallet can pass Ledger's Genuine Check

Former Mt. Gox chief executive Mark Karpelès has been examining suspicious Ledger Nano X devices through Tibane Labs, which has documented three generations of Ledger Nano X implants designed to intercept recovery phrases. Its report combines Joe Grand's teardown of an earlier implant with two specimens Tibane examined in September.

According to the research, the implants work by monitoring electronic signals sent between a wallet's secure element and its display.

During initial setup, a Ledger device generates a 24-word recovery phrase that lets its owner restore access to cryptocurrency holdings. Although the words originate inside a secure chip, they must pass through the device's display circuitry to appear on the screen.

Tibane Labs found that the modified devices contained additional microcontrollers that could read the screen's data, reconstruct the recovery words, and transmit them via cellular modems with SIM components.

Consequently, attackers could obtain the credentials needed to reconstruct a victim's wallet remotely without stealing the physical device or compromising Ledger's secure chip.

Earlier versions used visible wiring and smaller replacement batteries to accommodate the additional electronics. A more advanced version examined in September contained a custom circuit board hidden under the screen, with an LTE modem, an antenna, and components with removed identifying markings.

That version preserved the original battery and could appear normal even after its casing was opened.

Ledger's security documentation says Genuine Check verifies the secure element's authenticity but cannot detect unauthorized physical modifications, such as spying implants, if that element remains intact.

Tibane's two specimens were bought through Japanese marketplaces, rather than from CryptoBilis. Its report does not establish the design used in the reseller-linked thefts, and Ledger has not publicly described the implant it found.

Tibane Labs warned that a recovery phrase displayed on a compromised device should be treated as exposed. Replacing the device while reusing that phrase would leave an attacker able to access the wallet; funds must move to a wallet with a new phrase generated on a trusted device.

Investigators publish separate loss estimates above $90 million

Galaxy Digital research executive Alex Thorn reported on Oct. 9 approximately $91 million across 477 addresses on Bitcoin, Ethereum-related networks and Tron.

His analysis attributed $64.5 million of the suspected thefts to Tron, including approximately 64.3 million USDT.

Bitcoin accounted for another $17.7 million, equivalent to approximately 213 BTC, while Ethereum and related networks contributed $8.8 million.

A separate investigation by blockchain analytics firm Bitquery, updated Oct. 11, counted approximately $93.2 million in suspected thefts from 315 wallets across six blockchains. The two estimates use different address sets and methods; neither counts the number of tampered devices.

Bitquery also identified transaction patterns suggesting the attackers obtained control of multiple wallets before executing a coordinated withdrawal operation on Oct. 9.

Its analysis found that 25 Tron wallets signed the same token approval within three seconds, allowing approximately $29 million in USDT to be withdrawn within moments.

The firm also identified small test transactions conducted over roughly two weeks before the larger thefts, suggesting preparations began well before users reported missing funds.

In its Oct. 11 update, Bitquery estimated that Tether had frozen approximately $10 million in stolen USDT. It also identified $5.35 million in USDC that issuer Circle could freeze after funds moved through Tornado Cash and Zcash.

CryptoQuant analyst Darkfost suggested examining other regional resellers for possible supply-chain exposure, while acknowledging that the concern was speculative and unsupported by confirmed evidence.

Ledger said it was contacting affected users, coordinating with authorities, and working on enhanced anti-tampering protections.

It has advised customers who purchased devices from CryptoBilis not to initialize unused wallets. Those who have already completed setup should consider transferring their holdings to a trusted device using a newly generated recovery phrase.