Ledger confirms a hardware implant in a Nano X wallet
The company ties the drained funds to devices from a reseller in Malaysia; losses of $71 million to $86 million are outside estimates.
A device belonging to an affected user carried an unauthorized hardware implant, Ledger confirmed. The French company makes physical cryptocurrency wallets, and BleepingComputer reported the update on Oct. 12. Ledger had opened an investigation on Oct. 9 into funds drained from buyers in Southeast Asia.
In a post on X, Ledger attributes every reported theft to wallets shipped by CryptoBilis, a distributor based in Malaysia, and calls the affected volume "limited." It asked CryptoBilis to stop sales and shipments on Oct. 9, and the tampering was confirmed the next day.
For anyone who bought a wallet from that source, Ledger recommends not starting setup if the device is still unused. If it has been used, Ledger says to move the assets to a new wallet with a different recovery phrase, the seed that gives access to the funds, according to BleepingComputer.
Genuine Check, the test Ledger uses to confirm a device is authentic, does not detect an added implant if the factory secure element is intact, the same outlet reported.
The technical details do not come from Ledger. Mark Karpelès, former head of the Mt. Gox exchange, and the firm Tibane Labs examined Nano X units. They say the implant records the screen and the button presses to reconstruct the recovery phrase, then sends it over the cellular network through an eSIM. Tibane Labs describes two variants: one replaces the battery and the other fits under the padding of the OLED screen. The tampered devices had been on sale since Sept. 16 at nearly half their price, according to the researchers.
Outside analysts' estimates run from $71.5 million to more than $86 million, and Gizmodo cites Arkham Intelligence, which flagged about $71.5 million in the addresses involved. Ledger has not confirmed any figure or the number of victims. It did say on Oct. 9 that it sees no sign its systems were compromised.
It is still unknown at which stage of the supply chain someone placed the implant. CryptoBilis had not stated a public position in what was reviewed, and it is not established that the unit Karpelès photographed came from that reseller.
