Ledger Wallet Implant: What to Do If You Bought From a Reseller

Ledger confirmed on Oct. 10 that a hardware wallet belonging to one of the customers whose crypto was drained contained “an unauthorized hardware implant”, and on Oct. 11 it said every confirmed draining case so far involves “devices sold through the Southeast Asia reseller CryptoBilis.” On-chain researchers put the losses at roughly US$72 million to US$93 million across hundreds of wallets; Ledger has confirmed no figure. If you bought a Ledger from that reseller, Ledger’s advice is blunt: don’t set it up, and if you already have, move your funds to a new recovery phrase on a device bought from Ledger. If you bought from anyone other than Ledger, the steps below are worth 10 minutes.

What Ledger has confirmed about the CryptoBilis implant

The sequence, as Ledger laid it out on X and as BleepingComputer and The Hacker News reported it:

• Oct. 9: Ledger opened an investigation into fund losses among Southeast Asian users and said it had asked CryptoBilis to pause “all sales and shipments of Ledger devices”. It told anyone who had bought from the reseller in the previous 90 days not to start setup.
• Oct. 10: Ledger Support confirmed the implant in one affected user’s device.
• Oct. 11: Ledger called the number of affected devices “limited,” said its own systems and direct sales channels were not compromised, and said it was working with authorities. CryptoBilis has stopped all hardware wallet sales.

CryptoBilis is not a back-alley seller. The Block reported that it was listed as an official Ledger reseller in Indonesia, Malaysia and the Philippines. That detail changes the usual advice, and we’ll come back to it.

What Ledger has not said is just as important. It hasn’t named the device model involved in its confirmed case, hasn’t said how many devices were tampered with, and hasn’t said where in the supply chain the tampering happened. Binance co-founder Changpeng Zhao claimed on X that attackers had bought the reseller outright; CoinDesk notes that claim is unverified, and so do we.

The loss estimates also disagree with each other. On Oct. 9, The Block reported that on-chain researcher Tanuki42 had traced more than US$72 million to suspected theft addresses and pseudonymous investigator Specter more than US$86 million. CryptoSlate reports that Galaxy Digital’s Alex Thorn counted about US$91 million across 477 addresses, and that blockchain analytics firm Bitquery’s Oct. 11 update reached about US$93.2 million from 315 wallets, with roughly US$10 million in USDT frozen by Tether. None of these counts tampered devices, and none proves every drained wallet belonged to a CryptoBilis buyer.

How the spy implant steals a seed phrase, according to researchers

The clearest technical picture comes from outside Ledger. Mark Karpelès, the former Mt. Gox chief executive, published photos of a Nano X he received from Malaysia and said the implant “just monitors what’s shown on the screen”, according to Help Net Security. The board, tucked under the display padding, carries a microcontroller, an antenna, an LTE cellular chip and an eSIM. When the wallet shows your 24 recovery words during setup, the implant reads them off the display line and sends them out over the cellular network.

Tibane Labs, which tore down two implanted Nano X units, found one variant that swapped in a smaller battery to make room and another that kept the original battery and fit into the foam under the OLED screen, with its chip markings scraped off, BleepingComputer reports. Tibane described the newer board as “a designed, panelised flex PCB, the kind ordered from a board house, not a hand-built one-off.” Neither of Tibane’s units came from CryptoBilis: one was bought on Yahoo! Auctions Japan, and the other on Amazon Japan from a China-based seller shipping from Malaysia.

That is the honest limit of the evidence. As Ryder, a rival wallet maker, points out, no device from a victim who lost funds had been publicly torn down as of Oct. 10, so the drains and the implant research are two bodies of evidence that point the same way without yet being joined. The implant itself isn’t new, either: hardware hacker Joe Grand presented a reverse-engineered Nano X implant at hardwear.io USA 2026.

The Secure Element is real, so Genuine Check passes. The implant never touches it. It reads the screen.

Why Ledger Genuine Check passed a bugged wallet

Ledger’s Genuine Check proves that the Secure Element chip inside your wallet is one Ledger made. Ledger’s own security team says so precisely: the check protects against counterfeit and substituted devices, but it “cannot detect unauthorized physical modifications to the hardware, such as spying implants” and cannot verify a device’s supply-chain history.

The implant doesn’t need to break the chip. Your seed phrase has to appear on the screen at least once so you can write it down, and that is the moment it is captured. A device can pass every software check and still be bugged.

What to do if you bought a Ledger from a reseller

1. Find your receipt. Note who actually sold the device: Ledger directly, a named retailer, or a marketplace seller. On a marketplace order, the seller is the “Sold by” name, not the platform.
2. If it came from CryptoBilis and is still unopened or unused, stop. Don’t initialise it. Contact Ledger through official support channels, which is what Ledger asks affected users to do.
3. If you already use it, move your funds to a fresh seed on a new device. Ledger’s wording is to “move to a new seed on a device from Ledger.” If researchers are right about how the implant works, generating a new seed on the same suspect wallet won’t help: the new words would appear on the same bugged screen.
4. Bought from another unofficial seller? Apply the same logic. Ledger’s advice covers CryptoBilis, but researchers found implanted units sold through other channels. If you can’t account for where a wallet has been, treat its seed as exposed. Our read: the cost of a new device is small next to the balance it protects.
5. Never type the 24 words anywhere. “Ledger will never call you, DM you, or ask for your 24-word recovery phrase,” the company says. Scammers will use this news as cover, the same way voice-clone scammers use emergencies (here is how families beat those).
6. Report a loss. Affected users should contact Ledger Support and file a complaint with local law enforcement, per Ledger’s guidance.

Buying a hardware wallet on Amazon in the US

Ledger itself tells shoppers to favour “official Ledger storefronts or Authorized Resellers” on platforms including Amazon, and to compare the “Sold by” name with Ledger’s official reseller list before adding a wallet to the cart, because one Amazon product page can carry several sellers. Its buying guide adds the checks for when the box arrives: a genuine device never comes with a recovery phrase or PIN already set, and an opened or altered package means don’t use it.

The CryptoBilis case shows where that advice runs out. An authorised badge says a seller buys from Ledger; it says nothing about what happened to the box afterwards, which is why Ledger’s Oct. 11 update reminded its resellers to source only through authorised channels and never restock returned units. Our read: the shortest supply chain is the safest one, so buy directly from the manufacturer when you can, and be wary of any discount. BleepingComputer reported that implanted units researchers tracked had been sold for nearly half the original price.

None of this is unique to Ledger. Any device that shows a seed phrase on a screen can be bugged between the factory and your door. For more on the threats aimed at your accounts, see our privacy and security coverage, and our passkeys explainer for the exchange accounts that sit on the other side of your wallet.

There may be one physical tell. Karpelès noted that the implant’s antenna cable could reveal tampering, but you would have to open the case to see it. Most owners only think to look after the 24 words have already been on the screen.