Ledger wallet implant exposes a gap in its authenticity check

Ledger has verified that an unauthorized hardware implant was present inside a customer’s wallet, while independent researchers estimate that suspected cryptocurrency thefts have reached $93.2 million.

In a statement released on Oct. 10, the manufacturer of hardware wallets announced that the finding involved a device owned by one of the impacted individuals. The company added that CryptoBilis, which is an authorized reseller in Southeast Asia, has halted sales of its entire hardware wallet stock while the investigation remains ongoing.

The inquiry was launched after buyers reported cryptocurrency losses following the purchase of Ledger devices via the reseller. Ledger has not disclosed the total number of altered devices or confirmed whether the implant directly caused all of the reported losses.

According to Ledger, there is no evidence suggesting that its systems, services, or security infrastructure have suffered a compromise.

Why an implanted wallet can pass Ledger’s Genuine Check

Mark Karpelès, the former chief executive of Mt. Gox, has been analyzing suspicious Ledger Nano X units through Tibane Labs. The organization has outlined three generations of Ledger Nano X implants engineered to capture recovery phrases, combining findings from an earlier teardown by Joe Grand with two units evaluated by Tibane in September.

The research indicates that the implants operate by tracking electronic communications between the display and the secure element of the wallet.

During the initial setup process, a Ledger unit generates a 24-word recovery phrase that allows users to regain access to their crypto assets. Although these words are created within a secure chip, they must travel through the display circuitry of the device to become visible on the screen.

Tibane Labs discovered that the tampered devices featured extra microcontrollers capable of reading screen data, rebuilding the recovery words, and sending them out via cellular modems equipped with SIM components.

As a result, malicious actors can remotely acquire the credentials needed to access a victim’s wallet without taking the physical device or breaching Ledger’s secure chip.

Previous iterations utilized visible wiring alongside smaller replacement batteries to fit the extra electronics. Meanwhile, a more sophisticated version reviewed in September featured a custom circuit board concealed beneath the screen, complete with an antenna, an LTE modem, and components lacking identifying marks.

This latter variant retained the original battery and could maintain a standard appearance even after the casing was opened.

Ledger states in its security documentation that the Genuine Check feature verifies the authenticity of the secure element, though it cannot spot unauthorized physical alterations—such as spying components—if the secure element itself remains unaltered.

The two units analyzed by Tibane were purchased via Japanese online marketplaces rather than through CryptoBilis. Consequently, their report does not clarify which design was used in the thefts tied to the reseller, and Ledger has not publicly detailed the specific implant it uncovered.

Tibane Labs cautioned that any recovery phrase shown on a compromised unit must be treated as leaked. Reusing that phrase on a replacement device would still grant attackers access to the wallet, meaning funds must instead be transferred to a wallet with a fresh phrase created on a secure device.

Investigators publish separate loss estimates above $90 million

On Oct. 9, Alex Thorn, a research executive at Galaxy Digital, reported approximately $91 million in losses spanning 477 addresses across Bitcoin, Tron, and Ethereum-related networks.

His evaluation attributed $64.5 million of the suspected thefts to the Tron network, which included roughly 64.3 million USDT.

Bitcoin accounted for an additional $17.7 million, equal to about 213 BTC, while Ethereum and connected networks made up $8.8 million.

A separate analysis by the blockchain analytics company Bitquery, updated on Oct. 11, tallied roughly $93.2 million in suspected thefts across 315 wallets spanning six blockchains. Because the two estimates rely on different methodologies and address collections, neither tracks the total number of modified devices.

Bitquery also uncovered transaction trends indicating that the attackers secured control over multiple wallets prior to carrying out a synchronized withdrawal on Oct. 9.

Their findings showed that 25 Tron wallets authorized the exact same token approval inside a three-second window, enabling roughly $29 million in USDT to be withdrawn almost instantly.

Additionally, the analytics firm spotted small test transactions carried out over a span of about two weeks ahead of the major thefts, pointing to preparations that began well before users noticed missing funds.

In its Oct. 11 update, Bitquery calculated that Tether had locked approximately $10 million in stolen USDT. It also pointed to $5.35 million in USDC that could potentially be frozen by issuer Circle after the assets passed through Zcash and Tornado Cash.

Darkfost, an analyst at CryptoQuant, advised reviewing other regional resellers for potential supply-chain vulnerabilities, while noting that this concern remains speculative and lacks confirmed proof.

Ledger stated it is reaching out to impacted users, cooperating with law enforcement, and developing stronger anti-tampering defenses.

The company has recommended that users who bought devices from CryptoBilis avoid initializing any unused wallets. Individuals who have already completed the setup process should consider moving their assets to a trusted device using a newly generated recovery phrase.

?Frequently Asked Questions

01Can Ledger’s Genuine Check catch a hardware implant?

No. Ledger’s documentation explains that the Genuine Check confirms the authenticity of the secure element, but it cannot detect unauthorized physical modifications like spying hardware if the secure element itself is left intact.

02What should I do if I bought a Ledger device from CryptoBilis?

Ledger advises customers who purchased devices from CryptoBilis not to initialize unused wallets. If you have already set up the device, you should consider moving your funds to a trusted device using a newly generated recovery phrase.

03How do the hardware implants work?

According to researchers, the implants monitor electronic signals moving between the wallet’s secure element and its display. Additional microcontrollers read the screen data, reconstruct the 24-word recovery phrase, and transmit it remotely via a cellular modem.