In a troubling revelation for cryptocurrency users, Ledger has confirmed the discovery of an unauthorized hardware implant within a customer’s wallet, purchased from the Southeast Asian reseller CryptoBilis. This alarming finding comes amidst reports of significant crypto thefts, with losses potentially exceeding $86 million across major cryptocurrencies including Bitcoin, Ethereum, and Tron.
The situation began to unfold on October 9, when unauthorized transactions were reported by users who had bought devices from CryptoBilis, which operates in Indonesia, Malaysia, and the Philippines. Ledger is actively reaching out to affected customers and collaborating with law enforcement agencies as it continues its investigation.
While Ledger has not specified the model of the wallet or how the implant was installed, it has labeled this issue as an isolated incident tied solely to the reseller. The company emphasized that there is currently no evidence suggesting that its own systems or services were compromised.
Researcher Mark Karpelès has reported detecting additional electronics hidden behind the screen of a Ledger Nano X purchased in Malaysia, despite the packaging appearing intact. Security researchers from Tibane Labs identified that the implant included a microcontroller and cellular hardware connected to the screen’s data lines, which could potentially capture sensitive recovery phrases displayed during the device setup.
Ledger has urged any customers who bought wallets from CryptoBilis not to set up their devices. Those who have already initialized their wallets are advised to transfer their funds to a new wallet using a different recovery phrase to ensure their assets remain secure.
Assessing the Damage
Estimates from investigative firm Specter suggest that the total losses could exceed $86 million, while earlier reports had pegged the suspected thefts at over $72 million. According to Bitquery, around $92.9 million left 311 wallets across various blockchains, with a significant portion—approximately $70.5 million—originating from Tron wallets, and $16.8 million associated with Bitcoin.
Bitquery further indicated that around $10 million in USDT has been temporarily frozen, and some funds have been traced to Tornado Cash, a service known for obfuscating transaction histories. PublicAML noted that approximately 900 ETH were funneled to Tornado Cash on October 10, although Ledger has yet to verify these figures.
In a twist, former executives of CryptoBilis stated they relinquished control of the business in March following an ownership transition, but did not disclose who was responsible for modifying the device. Ledger has requested that anyone with relevant information contact its bounty program at bounty@ledger.fr. The company has also cautioned that its support team will never request a 24-word recovery phrase from users.
As of now, Ledger is still in the process of notifying users and has not released any information regarding potential suspects or arrests. The ongoing investigation remains a critical focus as the cryptocurrency community grapples with the implications of this significant security breach.
