Ledger has confirmed the presence of an unauthorized hardware implant in a device belonging to a user affected by the CryptoBilis case. The reseller has suspended its hardware wallet sales. Published on October 10, the confirmation gives the investigation a concrete basis, but does not validate every claim made in viral posts.
The figure of approximately $81 million comes from an on-chain estimate by Hacken covering Bitcoin, Ethereum and Tron. It is not an amount reported by Ledger, nor proof that every device sold had been tampered with. The technical issue lies elsewhere: a device can be genuine while still having been physically modified.
In brief
- Ledger confirmed an implant in one device, not in every wallet sold by the reseller.
- Hacken cited approximately $81 million tracked across three networks on October 9.
- Authenticating the secure chip does not guarantee that no additional surveillance hardware has been installed.
Ledger confirms an implant, not a widespread compromise
The case illustrates a limitation already discussed in our analysis of hardware wallet risks: protecting keys inside a resistant chip does not automatically resolve every manufacturing, shipping or resale risk. The integrity of the device delivered to the customer matters too.
In its October 10 update, Ledger said it had found an implant in a device belonging to an affected user. The company said it was working with those concerned, the authorities and Security Alliance. It added that it had found no indication of a compromise affecting its infrastructure, systems or services.
These findings do not make it possible to publicly identify who modified the device, nor to extend the diagnosis to every unit. A supply-chain flaw, an attack on central services and a general compromise of all wallets would be three different conclusions.
$81 million tracked, not just Bitcoin
The update published by Hacken on October 9 referred to approximately $81 million traced across eight addresses spanning Bitcoin, Ethereum and Tron. At the time, the team said the initial cause remained unknown.
Both aspects need to be kept in view: flows can be observed while their technical origin still requires investigation. The confirmation of an implant the following day does not, on its own, demonstrate that the implant explains all of the estimated losses.
The figure is a snapshot of the analysis, not a definitive judicial assessment as of October 12. Nor do the tracked addresses represent a count of victims: one person may use several addresses, while a collector may receive funds from multiple owners.
That is why checking a Bitcoin transaction in a block explorer can establish that funds moved, but cannot automatically identify the mechanism of the theft. A blockchain shows transactions; it does not record what happened inside the wallet.
Surveillance can target words displayed on the screen
The technical report by Tibane Labs describes implants added to genuine Ledger Nano X devices. The implants reportedly monitor data sent to the screen when the recovery phrase is displayed, then transmit the recognized words over a cellular connection.
The distinction from directly extracting private keys is important. In the mechanism studied, the attacker bypasses the protection by capturing the phrase when it must be shown to the user. Possessing that phrase can then make it possible to reconstruct the keys without breaking the secure component itself.
These findings are an analysis of specimens, not physical proof of every CryptoBilis theft. Tibane notably points out that one of its devices was not purchased from this reseller and that its report establishes no link between the two.
Researcher Joe Grand has also presented a reverse engineering analysis of a genuine Nano X implant, presented at hardwear.io USA 2026. The research documents a category of attack. Without recovering the original viral video, it is not possible to claim that the circulated images show the devices involved in this case specifically.
Why the authenticity check can still pass
The Ledger Donjon documentation explains that the Genuine Check authenticates the Secure Element. The component responds to a cryptographic verification attesting to its origin. The check is not a physical inspection of every component around it.
Ledger explicitly acknowledges that an added surveillance implant may go undetected if the original Secure Element remains intact. The device can therefore pass the test because its chip is genuine while still containing an unauthorized addition.
The packaging is not enough either. The same documentation explains that seals can be replicated and that a box can be opened and resealed. The question is therefore not limited to whether a device is a “genuine or fake Ledger”: it also concerns what may have been added to an authentic device.
What Ledger recommends to affected buyers
In its October 10 update, Ledger advised customers who bought from this reseller not to begin setting up a device that had not yet been used. For those who had already set it up, the company recommended considering moving their assets to a new device with a new recovery phrase.
The new phrase is the decisive point. Restoring the same words on another device does not change the keys controlling the funds. This distinction is central to how a crypto wallet works.
These instructions apply to customers concerned by the investigation, not to all Ledger users as a group. Security precautions against phishing remain essential: no purported support representative should be given the recovery phrase to “verify” or “repair” the wallet.
Reseller approval does not close the investigation
At the time of our check, Ledger’s official list for Malaysia showed CryptoBilis with a notice that sales were temporarily suspended. Its affiliation with the reseller network can therefore be verified; the exact duration cited in the viral message cannot be confirmed from that page alone.
The reseller’s commercial status proves neither that no hardware was altered nor that anyone working for the distributor was responsible. Responsibility, the number of devices affected and the link between each loss and each device remain to be established.
The confirmed fact is serious enough without exaggeration: an implant was found and sales were halted. The investigation must now link the devices examined to the transactions observed. That demonstration, rather than the circulation of a dramatic video alone, will determine the attack’s true scope.
