A wallet that passed the genuine check

Ledger has described how an unauthorised implant in devices sold through a Southeast Asian reseller stole owners' recovery phrases. In an update on X on Tuesday, the company said its Donjon security team found that the implant sits inside the enclosure and reads what is shown on the screen. When the device displays the 24-word recovery phrase during setup, a microcontroller decodes the words and transmits them over LTE using a provisioned eSIM. Ledger said the implant is a separate component that does not modify the Secure Element or its operating system and does not alter transactions or signatures.

Ledger first said on 9 October that it was investigating losses among users in Southeast Asia who had bought from the reseller, CryptoBilis, and asked it to pause sales and shipments. In a 72-hour update on Sunday it said "all confirmed cases related to the disclosed draining incident of Oct 9th, 2026, involve devices sold through the Southeast Asia reseller CryptoBilis", that its systems and direct sales channels were unaffected, and that CryptoBilis had stopped selling hardware wallets. On Tuesday evening it asked resellers and distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales and take its devices off the shelves while the investigation continues.

The size of the losses is not established. Ledger said on Tuesday that it has not confirmed the number of affected users or the total value lost, and that figures circulating online come from third parties and have not been fully verified. On-chain researchers put the total above $86m on the day of the drain. Bitquery, a blockchain analytics company, has since counted $102.0m taken from 324 wallets on six blockchains, a figure it has revised upward as it found more drained wallets.

Much of the public detail on the hardware came first from Mark Karpelès, the former chief executive of Mt. Gox. He posted photos of a small board hidden under a device's screen and said that all versions he had seen carry an LTE chip, an e-SIM and an antenna, and that the implant "just monitors what's shown on the screen". The unit still passed Ledger's Genuine Check, he said, because the security chip is real, Help Net Security reported. Accounts of where he bought it differ. Help Net Security and other outlets said his tampered unit was bought in Malaysia; The Block reported that he said on Tuesday that a Ledger Flex bought at Singapore's airport contained an implant, and that Ledger had not confirmed a link to the same incident.

The question now is whether the problem stops at one reseller. Ledger said on Tuesday that MediaMarkt Saturn has, with Ledger's alignment, stopped selling its devices in stores and online after one customer in Germany reported an implant, and that no loss of funds was reported in that case. A user on X had posted photos on Sunday of a device he said he had bought in store from an official reseller in Europe, and German outlet BTC-Echo reported that a second unit he bought at MediaMarkt in Germany on 12 October also held an implant. Those claims are unverified. Ledger says it is reviewing reports of implants in other devices and locations and has not verified a drain linked to a device bought outside Southeast Asia.

Ledger's advice is not to set up a device bought from CryptoBilis and, for anyone who already has, to move assets promptly to a new device with a new recovery phrase. Its first notice addressed buyers from the last 90 days. Bitquery found that about six in ten of the victim wallets it checked first received funds inside that window and more than eight in ten from June onward, which it said suggests the risk may reach back about four months. Ledger tells users who lost funds to coordinate with law enforcement before opening the device.

Rivals have moved to limit their own exposure. Trezor said it had seen no evidence that its devices were compromised and is cutting back its reseller network, with notified resellers losing authorisation on 1 January 2027, The Block reported. OneKey offered free replacements for devices bought through CryptoBilis between 1 March and 13 October, according to the same report.

The episode moves the risk from the wallet's software to its supply chain. A device can carry genuine components and still be altered after it leaves the factory, and a check that verifies the chip does not examine what is wrapped around it. Komposite has covered who holds the keys when owners do not, and infrastructure compromises on the enterprise side. Ledger says it is still investigating who tampered with the devices and where in the distribution chain it happened.