Science & Tech · Cybersecurity · 7 hrs ago
Ledger Confirms Hardware Implant in Wallet Sold by Authorized Reseller
Ledger confirmed that one device sold by CryptoBilis, an authorized reseller in Southeast Asia, contained an unauthorized hardware implant.
The confirmation followed reports of a supply-chain attack involving Ledger wallets.
Former Mt.
Gox CEO Mark Karpelès said he found implants in two Ledger devices he bought from other sellers.
He had raised concerns about implants before Ledger’s public warning.
An on-chain investigation estimated that attackers took $93.2 million from 315 wallets across six blockchains, but that figure is not official.
Tether reportedly froze about $10 million of the stolen USDT.
Some people credit Karpelès’s warnings with prompting attackers to move sooner, but that theory has not been confirmed.
Ledger confirmed that a hardware wallet sold through authorized reseller CryptoBilis contained an unauthorized hardware implant.
The affected devices were linked to a supply chain attack, with third-party investigators estimating $93.2 million was stolen from 315 wallets across six blockchains.
Ledger’s confirmation followed posts by former Mt. Gox chief Mark Karpelès about implants he found in Ledger devices.
The estimate is not an official figure from Ledger, and the theory that Karpelès’s posts prompted attackers to drain wallets sooner remains unconfirmed.
- Who
- Ledger confirmed the implant; the affected wallet was sold through CryptoBilis, an authorized reseller in Southeast Asia.
- What
- At least one Ledger hardware wallet contained an unauthorized hardware implant.
- When
- Ledger publicly warned about the issue on Saturday. The article was published on October 12, 2026.
- Where
- The device was sold through CryptoBilis, an authorized Ledger reseller in Southeast Asia.
- Why
- The motive for placing the implant is not stated.
This story does not have two clearly opposing sides.
Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant
Spy implant in @Ledger Nano X, back in the days and now, that’s quite an evolution
It is reasonable to assume that @MagicalTux doing physical audits of ledgers from resellers, to then find tampered hardware, identifying the supply chain attack saved hundreds of millions of dollars (if not billions one day) of wealth
Yes very impressive, the attack could have gone on for years unnoticed
Karpelès posted about a spy implant in a Ledger Nano X and shared photos of an older and a newer implant.
Karpelès posted a warning about buying cheap Ledger devices from dubious sellers.
The supply chain attack became apparent to crypto users, according to the article.
Ledger issued its first public warning about the issue and confirmed an unauthorized implant in an affected device.
Bitquery updated its third-party estimate of losses to $93.2 million from 315 wallets across six blockchains.
- Affected reseller
- CryptoBilis
- Reseller status
- Authorized Ledger reseller in Southeast Asia
- Estimated losses
- $93.2 million
- Wallets affected in estimate
- 315
- Blockchains in estimate
- 6
- Frozen funds
- About $10 million of stolen USDT
Sources
Related news
Cyberattack disables refrigerators at French supermarket stores
Critical SonicWall flaw faces exploitation days after patch
Ledger confirms a tampered wallet device in crypto theft investigation
Canadian cybersecurity executive arrested on federal extortion charges
Yandex outage did not show a broad drop in Russian bot activity
Canadian cybersecurity executive arrested in FBI ShinyHunters investigation
ShyGlass blurs Mac screens when users turn their heads
Japan Declares Cybersecurity Emergency After Attacks on More Than 20 Companies
Leaked files reveal Luna Moth’s methods for extorting organizations
GitLab patches critical flaw in self-managed server software
Ricardo users receive phishing messages after data leak
