Ledger confirms hardware implant in affected device; CryptoBilis pauses all wallet brands

Ledger has told reporters that at least one of the devices tied to the ongoing CryptoBilis theft contained a hardware implant, per The Defiant on October 10. The reseller — a former Ledger partner across Indonesia, Malaysia and the Philippines — has also widened its sales pause to every hardware wallet brand it carries, including Trezor and Tangem, not only Ledger. The investigation now has a device-level cause for at least one case, closing out the open question flagged in our October 10 USDD-swap post.

What is new

Two pieces move today, both relayed by The Defiant:

• Ledger's position. On Friday, the company told The Defiant that an affected user's device contained a hardware implant. Ledger had previously confirmed the thefts and suspended CryptoBilis as an authorised reseller as this site covered on October 9. The company had not, until now, attributed any single device to a specific tampering mechanism.
• CryptoBilis's response. The reseller has stopped selling all hardware wallet inventory, widening a request that originally covered Ledger devices only. The Southeast Asian storefronts carrying Trezor and Tangem are included in the halt pending the investigation.

Ledger has not published a device-level technical write-up on its own blog as of this post; its most recent corporate posts are product and release-notes entries from October 7 at ledger.com/blog. The hardware-implant attribution is coming through press statements, not an advisory page.

Prior art

Hardware implants in a Ledger Nano X are not new as a research subject. Joe Grand (Kingpin) presented "Reverse Engineering a Ledger Nano X Hardware Implant" at Hardwear.io USA 2026 in May, with the project page describing hardware espionage as "intentionally compromising a product's integrity or modifying its functionality to benefit an attacker." Grand's slide deck notes a case in which a user bought a secondhand Nano X online, noticed the battery was smaller than it should be, and found a small circuit board with wires and an antenna fitted into the freed space — a design meant to transmit data wirelessly and exfiltrate the recovery seed during setup.

Grand's work is a different incident from CryptoBilis, but it establishes two things that matter here: hardware implants that leak the 24-word seed over an RF channel are a documented class of attack against Nano X, and the external secure-element checks — the chip-level attestation Ledger relies on — do not necessarily detect such add-on circuitry, because the implant can sit outside the secure element on an auxiliary board.

What Ledger has confirmed and what it has not

Confirmed via the October 10 statement:

• At least one affected device carried a hardware implant.
• CryptoBilis has stopped selling all hardware wallet brands pending the investigation.

Not yet confirmed by Ledger directly:

• The specific implant design (SIM / LTE module, Bluetooth, logging-only variant). Photographs of an alleged implant, including an LTE-capable board hidden in the screen padding, were circulated by Mark Karpelès on X in September and have not been corroborated at the device level by Ledger.
• Whether every drained device carried the same implant, or whether some losses trace to a different vector such as a seed-generation flaw or operator key leakage at the reseller.
• A revised dollar figure. Public estimates currently range from Specter's $86M to Bitquery's $92.9M across 311 wallets on five chains to Yfarmx's $93.4M across 471 addresses, none of which Ledger has endorsed.

Impact and counterparty exposure

For users:

• Anyone who bought from CryptoBilis in the last 90 days should treat the device as compromised. Ledger's guidance to move funds to a new Ledger with a new recovery phrase remains in force.
• Buyers from CryptoBilis of Trezor or Tangem devices should now treat those as potentially compromised too, following the reseller's own pause. Neither Trezor nor Tangem has published a parallel advisory as of this post, but the pause itself warrants caution.
• The hardware-implant class means a hygienic PIN, a correct 24-word setup and genuine-looking packaging are no longer sufficient signals. The implant can read the screen and transmit without touching the host PC or the Ledger Live software.

For integrators:

• Address-screening against the Bitquery, MistTrack and Chainalysis address lists remains the operational surface. The theft cluster has already converted part of its USDT into USDD on SUN.io to escape Tether's blacklist — see yesterday's post — and the USDD stock is unreachable via addBlackList.

What to watch

1. A Ledger blog advisory with photos and chip-level details. The press-statement cadence is not sustainable; a formal advisory with a photograph of the implant and a bill of materials is the next step.
2. A Trezor or Tangem advisory. Both vendors sell through CryptoBilis in the region. A unilateral tampering statement from either would signal whether the implant class has crossed brands.
3. The buyer side of the CryptoBilis supply chain. The question is whether the implant was fitted in the reseller's warehouses or earlier up the chain. The answer determines whether every device bought in the last 90 days, not only in Southeast Asia, is suspect.
4. A Grand or independent teardown of a CryptoBilis unit. The current attribution rests on Ledger's unphotographed statement and on Karpelès' photos. A third-party teardown would end the ambiguity.

Context

Supply-chain tampering of hardware wallets has moved from a demo-class risk to a confirmed loss event with nine-digit damage. The pattern — modified-device dispatch via an authorised reseller — mirrors the 2020 Ledger database leak that enabled scam-package mailings, with the difference that in 2020 the tampered devices came as unsolicited packages, and in 2026 they came through the vendor's own regional retail channel. The remaining lever is end-user signature of the device at a chip-and-firmware level, which no major hardware wallet currently exposes outside of its own secure-element attestation. Until that changes, the counterparty assumption — that a sealed box from an authorised reseller is safe — no longer holds in markets where this incident has been reported.