Two days after it began looking into reports of emptied wallets in South East Asia, Ledger said on October 11 that every report of an unexpected drain it had received traced back to devices sold through a single reseller, the Malaysian company CryptoBilis, and that the number of affected devices was limited.
A day earlier the company had confirmed that an unauthorized hardware implant had been found inside at least one of those devices. Ledger has not described it, but a teardown report published by Tibane Labs in the same week shows what such an implant can look like: a flexible circuit concealed within an otherwise genuine Ledger Nano X that reads the recovery phrase off the wires feeding the screen and sends it to the attackers over a mobile network.
Three statements in three days
Ledger's first notice, on October 9, said it was investigating losses reported by South East Asian users who had bought from CryptoBilis and that it had asked the reseller, as a precaution, to stop selling and shipping its products. The implant confirmation followed on October 10. The October 11 update added that Ledger was working with the authorities. Ledger has also said it has seen no such reports from customers who bought directly from it.
CryptoBilis, which Ledger's own reseller directory still lists under Indonesia and Malaysia with a note that sales are temporarily paused, has suspended sales of all hardware wallets. The people who founded the company told Tibane Labs that new owners took it over earlier in 2026, that they completed the handover in March and that they lost all access to its systems at that point. Ledger, for its part, has reminded authorized resellers and distributors to buy stock only through official channels and never to put returned units back on sale.
What the teardown found
Tibane Labs examined two implanted Nano X units it obtained in September through Japanese marketplaces, one from an auction site and one from a seller based in China that shipped the parcel from Malaysia. Neither came from CryptoBilis, and the researchers say plainly that they hold no evidence tying the two together: they have examined nothing sold by the reseller, and Ledger has not said what caused the losses. Mark Karpeles, the former head of the Mt. Gox exchange, had earlier published photos of an implant behind the screen of a Nano X that arrived from Malaysia, and said its antenna cable was what gave it away.
Both specimens work the same way. A flexible printed circuit is soldered onto the Nano X's board, in the first specimen onto its factory test pads, drawing its power from the Ledger's own battery and tapping the three unencrypted wires that carry pixels to the display. A microcontroller watches that traffic, recognizes the letters of the 24 recovery words as they appear during setup, and keeps the words until a cellular modem on the same board, with its own eSIM and antenna, forwards them to the attackers. The Secure Element, the chip that holds the keys, is never touched, so the device behaves normally and passes Ledger's Genuine Check, which Ledger's own documentation says cannot detect added hardware when that chip is intact.
The two boards differ in how well they hide. In the first, an STM32G431 microcontroller, an eSIM measuring 2 by 2 millimeters and a shielded LTE module sit in space freed by swapping the battery for a smaller one. The second is coated black, fits into the cavity left where the foam pad under the display was torn out, keeps the original battery, carries a Nordic LTE module beside a larger microcontroller and eSIM with their markings scraped off, and is cut so precisely around the Ledger's own components that it drops into place without alignment. An early, hand soldered prototype surfaced in August 2025; Tibane Labs reads the newest board as a design for mass installation rather than a hobbyist's project.
What buyers should do
Ledger's advice to CryptoBilis customers is the part that matters. A device bought from the reseller in the previous 90 days and not yet set up should stay in its box. One that has been set up has already shown its recovery phrase to whatever is inside it, so funds should move to a wallet whose seed was generated on a device the owner trusts, and the old phrase must never be typed into a replacement. Tibane Labs adds that this holds even if the wallet was never connected to anything.
How much was taken is still a matter of estimates by blockchain analysts, not of figures from Ledger. Published tallies run from above 72 million to about 93 million dollars across several hundred wallets, most of it in USDT on Tron, of which, by one analytics firm's count, Tether has frozen roughly 10 million dollars; Ledger has confirmed neither an amount nor a cause. What it has confirmed is enough on its own: a genuine Ledger device, bought from an authorized reseller, carried an implant of a kind that Ledger's own documentation says its authenticity check cannot detect.
