Ledger has confirmed that hardware wallet devices sold through CryptoBilis, a major Malaysia-based reseller operating across Southeast Asia, were physically compromised with spy implants designed to steal cryptocurrency. The company asked CryptoBilis to halt all sales on October 9 and confirmed hardware tampering on at least one device the following day. All reported fund drains trace back to devices purchased through this single reseller. The implants are sophisticated. Researchers at Tibane Labs identified two variants hidden inside Ledger Nano X devices. Both captured the device's display output and button presses to reconstruct the seed phrase — the master key to a user's crypto holdings — then transmitted it to the attacker over an LTE connection using a tiny 2×2mm eSIM. The first variant replaced the original battery with a smaller one to make room for a custom flex PCB, an STM32G431KBU6 microcontroller, and a shielded LTE module. The second, more advanced variant ran on the original battery and fit into the foam padding space under the OLED display. Mark Karpelès, former CEO of Mt. Gox and now CTO at Shells.com, described the newer implant as "quite an evolution" from earlier versions that used manually soldered wires. The tell-tale in both variants was an antenna wire running along the device's top edge. Tibane Labs noted that the flex PCB was "ordered from a board house, not a hand-built one-off" — indicating this was a manufactured operation, not a hobbyist project. The attack vector is a textbook supply-chain compromise. Tampered devices were reportedly available at nearly half the retail price, an obvious lure for cost-conscious buyers in Southeast Asian markets. Devices appeared on Amazon Japan from a China-based seller shipping from Malaysia, and on Yahoo! Auctions Japan. Ledger's own "Genuine Check" mechanism — designed to verify device authenticity — explicitly cannot detect added implants when the original Secure Element chip remains intact. The security boundary that Ledger designed stops at the chip; everything around it is fair game. This is the structural problem. Hardware wallets exist because software wallets are vulnerable to remote attacks. But hardware wallets introduce a physical supply chain that must be trusted end-to-end. Ledger's security architecture assumes the Secure Element is the trust anchor, but the implant bypasses it entirely by reading the screen and buttons — the human interface layer — rather than attacking the cryptographic core. The attacker didn't need to break Ledger's cryptography. They just needed to watch the user type. Ledger describes the affected volume as "limited" and is working with authorities to identify the perpetrators. The company advises users who purchased through CryptoBilis to avoid setting up unused devices and to migrate assets from already-configured ones to a new device with a fresh seed phrase. The broader recommendation is to buy only through authorized channels. The community response has been predictable and justified: calls to dismantle the third-party reseller network entirely. The incident exposes a tension that hardware wallet companies have long minimized — the gap between cryptographic security (which Ledger does well) and physical supply-chain security (which no single company can fully control). There is currently no indication that other resellers are shipping compromised devices, but the trust damage extends well beyond CryptoBilis.
