Ledger Confirms Spy Implant Compromise in Hardware Wallets
Ledger has confirmed that certain hardware wallets distributed through the Southeast Asian reseller CryptoBilis were compromised by a hardware implant that drained users' cryptocurrency wallets. The company has been investigating reports of users losing funds from wallets purchased through CryptoBilis, a major retailer based in Malaysia that operates across Southeast Asia.
Researchers first identified the implant in Ledger X devices on September 16, noting that tampered devices were available at nearly half the price of the original hardware. Ledger wallets are designed to securely store the private keys that control cryptocurrency assets and authorize transactions.
On October 9, Ledger announced it had launched an investigation into user reports of cryptocurrency losses and requested CryptoBilis to halt sales and shipments of Ledger devices. The following day, the company confirmed that at least one device had been tampered with, although the specifics of how or when the tampering occurred remain unclear.
"Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant. Ledger is reaching out to impacted users as part of the ongoing investigation," the company stated. Ledger is also collaborating with authorities to identify the perpetrator and pursue justice.
The company advised users who purchased a Ledger device from CryptoBilis not to initiate setup if they had not already done so. For those who have set up their devices, Ledger recommended moving assets to a new Ledger signer with a new seed.
In a subsequent update, Ledger confirmed that all user reports of unexpected fund drains were linked to devices sold through CryptoBilis, describing the affected volume as limited. While the company did not disclose the specific types of devices compromised, reports indicate that a spy implant was found in Ledger X devices, blending with the legitimate hardware.
Insights from a Security Expert on the Implant
Mark Karpelès, currently leading Karpeles Lab Inc. and serving as CTO at Shells.com, showcased a picture of the new implant in Ledger X, describing it as a significant evolution from previous versions that featured manually soldered wires. Karpelès noted that the implant was concealed behind the screen, although its antenna cable suggested something was amiss.
According to Karpelès, the malicious hardware captured the device's display output and button presses to identify the seed phrase, transmitting this information to the attacker over an LTE connection using an eSIM. He explained, "Ledger Nano X are used to store crypto. The spy implants are used to steal whatever crypto you store in those Ledger Nano X."
While Karpelès did not name CryptoBilis as the vendor of the compromised Ledger X, he mentioned that the device was not purchased through Ledger's recommended channels but from a well-known platform via a Chinese seller, with the product shipped from Malaysia. Tibane Labs, a cryptocurrency research and development studio, corroborated Karpelès' findings, revealing that they had obtained two implant versions for Ledger X.
Researchers discovered that the threat actor made room for the malicious circuitry by replacing the original battery with a smaller one, which powered both the implant and the Ledger X. They identified components such as an ST STM32G431KBU6 microcontroller and a tiny eSIM used for connectivity, which was concealed to hide its part numbers.
Clearance Granted
Ledger has advised users to avoid purchasing from unauthorized resellers, as this increases the risk of acquiring counterfeit or modified devices. The company is also reminding authorized resellers and distributors to source products only through authorized channels and to refrain from restocking returned items. Although Ledger provides a ‘Genuine Check’ mechanism to verify device authenticity, it warns that it cannot detect added implants when the device’s original Secure Element remains intact.
Currently, there is no indication that other Ledger resellers are shipping compromised wallets. However, the incident has undermined community trust in the reseller network, prompting calls for its reevaluation.
