A Bug in the Crypto Wallet: Ledger Confirms a Hardware Implant

Set Trending Topics as a preferred source on Google.

The suspicion is now official, and for Ledger it is a heavy blow: The French hardware wallet maker has confirmed that one affected customer’s device contained an “unauthorized hardware implant.” Ledger’s support team made the announcement on X. It is now clear that at least some of the devices used to rob customers in Southeast Asia of crypto assets worth tens of millions of dollars had been physically tampered with.

What a Hardware Implant Is

A hardware implant is an additional electronic component that is secretly built into a device after the fact. It leaves the software untouched and grabs data directly from the electronics. For a hardware wallet, that is especially dangerous, because the device displays the recovery phrase during setup. Those 24 words are usually enough to recreate the wallet elsewhere and drain the crypto assets without the device itself.

That is most likely how the attack worked. Shortly after the thefts became known, Mark Karpelès, the former head of Mt. Gox, took apart a still-sealed device bought in Malaysia and found a hidden second circuit board inside. According to a technical analysis by Tibane Labs, the board sits behind the display of the Ledger Nano X and consists of a microcontroller and cellular hardware wired to the screen’s internal data lines. This allows the implant to read what is displayed during setup and send the recovery phrase over a mobile network. Ledger’s own firmware does not notice, because the secure chip itself is left untouched. Ledger has not yet confirmed how the implant works.

Which Devices Are Affected

The affected devices were sold through CryptoBilis, an official Ledger reseller for Indonesia, Malaysia and the Philippines. Ledger’s advice to anyone who bought there:

• Not yet set up: Do not set up the device at all.
• Already set up: Move your crypto assets to a new Ledger device with a new recovery phrase. Transferring the old phrase to a new device is not enough, because it has to be considered compromised.

CryptoBilis has since halted sales of all hardware wallets until the investigation is concluded. That includes devices from competitors such as Trezor, Tangem, SafePal and OneKey, which the reseller also stocks. Whether tampered devices from those brands were shipped as well is unclear. Ledger stresses that it has “no indication that Ledger’s security infrastructure, systems or services have been compromised.” Devices bought from its own online store are not affected, the company says. Ledger is being supported in the investigation by SEAL 911, an emergency response team of crypto security researchers, and is working with the authorities.

What Was Stolen

Ledger has not given an official figure for the losses. In its analysis, the blockchain analytics firm Bitquery puts them at $92.9 million (about €83 million) from 311 wallets:

• USDT on Tron: The largest share consists of Tether stablecoins worth about $70.5 million (about €63 million).
• Bitcoin: about $16.8 million (about €15 million).
• Other coins: Ether as well as crypto assets on BNB Chain and Polygon.

According to Bitquery, about $10 million (about €9 million) in USDT has been frozen. The attackers have already routed part of the stolen Ether through the crypto mixer Tornado Cash to cover their tracks.

Security researcher Taylor Monahan nonetheless warns against panic: The case does not look like a previously unknown vulnerability in Ledger’s technology, she said. The bigger danger now comes from scammers targeting worried customers with fake Google ads, phishing sites and copycat apps. Ledger also warns that it will never ask for a user’s recovery phrase.

Not Ledger’s First Trouble

For Ledger, the incident adds to a long list of problems:

• Data breach in 2020: Attackers stole the email addresses of more than one million customers, and for hundreds of thousands also their names, phone numbers and home addresses. The data set was later published openly online.
• Fake devices in 2021: Scammers used the leaked addresses to mail tampered Ledger devices, complete with official-looking letters, that prompted customers to enter their recovery phrase.
• Ledger Recover in 2023: An optional service for backing up the recovery phrase sparked fierce criticism because it showed that the firmware can, in principle, export key material.
• Connect Kit attack in 2023: Attackers injected malicious code into a software library that many crypto apps use to connect Ledger wallets, stealing about $600,000.
• Kidnapping in 2025: Ledger co-founder David Balland was kidnapped in France and freed only after a police operation.
• Global-e in 2026: Early this year, a data breach at the payment provider Global-e exposed the names and contact details of Ledger buyers.

Ledger now says it is working on further safeguards against physical tampering, but has given neither details nor a timeline. The core promise of hardware wallets, that the recovery phrase never leaves the device, offers little protection once the device itself is no longer what the manufacturer shipped.