Genuine Check Passed: The Secure Element Was Genuine, But the…

Ledger confirmed an unauthorized hardware implant in a Nano X sold by CryptoBilis. The chip captures display output and button presses to identify the seed phrase, then exfiltrates it via cellular LTE. The incident caused estimated losses between $86 million and $93 million, though the source does not establish whether the implant caused all reported losses or only a portion.

Ledger confirmed on October 9, 2026, that at least one compromised Nano X device contained an unauthorized hardware implant, sold through the Southeast Asian retailer CryptoBilis. The component, hidden behind the OLED screen, captures display output and button presses to identify the seed phrase, then transmits it via cellular LTE. The incident caused estimated losses between $86 million and $93 million, though the source does not establish whether the implant actually caused all reported losses or only a portion.

Key Takeaways

Ledger confirmed an unauthorized hardware implant in at least one Nano X device, with all verified cases traced to the retailer CryptoBilis
The implant uses an STM32G431KBU6 MCU, 2x2 mm eSIM, and shielded LTE module to capture display output and button presses
The device passed Ledger's "Genuine Check" because the original Secure Element remained intact
According to independent researchers at Tibane Labs, two implant variants exist with different battery and antenna configurations
On-chain loss estimates range from $86 million to $93 million across hundreds of wallets, per Bitquery and other independent analyses

How the Implant Works: From Flexible PCB to Cellular Transmission

Analysis by Tibane Labs revealed an implant of industrial sophistication. According to the researchers, it is "a panelized flexible PCB, the kind ordered from a board house, not hand-built." The heart of the system is an STM32G431KBU6 microcontroller (Arm Cortex-M4, 128 KB flash, UFQFPN-32 package), positioned under the Ledger Nano X battery alongside a shielded LTE module and a square 2x2 millimeter eSIM.

Researcher Mark Karpelès, former Mt. Gox CEO, described the mechanism: the implant "simply monitors what is shown on the screen, will take note of the seed [phrase] while it is shown to you, then transmits [it to the attacker]." Positioned behind the OLED display, it observes what the user sees, while keylogging completes the capture of the sequence. Transmission occurs via cellular network, independent of the computer to which the wallet is connected.

According to independent researchers at Tibane Labs, two implant variants exist. The first mounts a smaller-than-original battery with the antenna positioned above; the second uses the original Ledger battery, with the MCU and eSIM shaved down to reduce thickness and the antenna placed along the top edge of the device. Both versions replace the original padding behind the screen while maintaining unchanged external dimensions. Ledger confirmed the implant in at least one device; multiple variants were identified by researchers, not officially confirmed by the company.

The Genuine Check: Genuine But Insufficient

Ledger's "Genuine Check," the official application users run at startup, verifies the presence and authenticity of the Secure Element: the cryptographic chip that safeguards private keys. Because the implant neither replaces nor alters this component, the check returns a positive result.

The device analyzed by Tibane Labs arrived with intact original packaging and passed the Genuine Check, because the internal security chip was authentic. The system does not provide for verification of the physical integrity of the housing, connectors, and signal paths between peripherals and the main processor.

Users lack household tools to detect this type of compromise. The implant is invisible to superficial inspection, operates without altering device behavior, and generates no anomalies detectable by management software. Only disassembly with identification of additional components reveals its presence.

The Supply Chain Path: CryptoBilis at the Center of the Investigation

All cases confirmed by Ledger trace back to a single distribution channel. The updated statement of October 11, 2026, specifies that "all confirmed cases related to the draining incident disclosed on October 9, 2026 involve devices sold through the Southeast Asian retailer CryptoBilis." The retailer has suspended all hardware wallet sales pending investigation.

Details on the exact point of implant insertion in the logistics chain remain unverified. The source does not specify when and where the manipulation occurred, nor whether it involves only CryptoBilis' warehouse or earlier transport phases. Ledger has opened an investigation with competent authorities; no infrastructure overlaps linking the operation to a specific actor have emerged to date.

An unproven contextual element concerns CryptoBilis' change of ownership, which occurred in March 2026. Former executives reported the ownership change as a contextual element, but the source does not establish a causal link with the incident. Ledger has not released an estimate of the total number of compromised devices, limiting itself to defining the phenomenon as "limited."

"Ledger can confirm that one of the impacted users' devices contained an unauthorized hardware implant. Ledger is reaching out to impacted users as part of the ongoing investigation" — Ledger Support (via X/Twitter)

The Damage Figures: On-Chain Estimates Between $86 Million and $93 Million

Economic losses were estimated by multiple independent analysts through on-chain tracking, with figures showing variability linked to different timelines and methodologies. Bitquery quantified $92.9 million across 311 multi-blockchain wallets, of which $70.5 million on the TRON network (predominantly USDT) and $16.8 million in Bitcoin. Specter reported an initial estimate of $86 million.

These figures are not officially confirmed by Ledger, which has not released its own loss estimate. The source does not establish whether the implant actually caused all reported losses or only a portion. The gap between estimates reflects the difficulty of causal attribution in on-chain tracking, where suspicious movements may coincide with other malicious operations unconnected to the hardware implant.

What to Do Now

Ledger recommended that users who purchased devices from CryptoBilis not initialize wallets not yet configured and move funds to a new seed generated on verified hardware. The company indicated a 90-day period for migration operations, without however clarifying on what basis this timeline was chosen: 90 days represent a prudent window or an estimate of residual risk? The source provides no elements to verify whether the period is adequate or arbitrary.

For devices already in use, verification passes through the purchase chain: those who bought from CryptoBilis or do not recall the distribution channel should consider the concrete risk of compromise. Those who purchased directly from Ledger or from verified retailers are not included in confirmed cases, though the incident raises general questions about the traceability of the cryptographic device supply chain.

Ledger's recommendation assumes the user can identify their device's provenance with certainty, which is not always guaranteed for second-hand purchases or gifts. The company has not made a public registry of involved serial numbers available, limiting individual verifiability.

Why This Incident Changes the Paradigm

Hardware wallets are designed to isolate private keys from potentially compromised environments. This incident shifts the problem from software to the physical enclosure: the attack does not violate the Secure Element's cryptography, but bypasses its purpose by observing what the user enters and views.

The case highlights a known limitation of the Genuine Check: it verifies the chip's authenticity, not the integrity of the entire device. It is not a flaw in the system per se, but a characteristic that security device buyers often fail to understand. The difference between "authentic chip" and "untampered device" remains a blind spot for those relying exclusively on automated checks.

The LTE implant adds an element of operational independence: it requires no access to the user's network nor compromise of the connected computer. This distinguishes it from more conventional attacks that pass through malware or phishing, though the source does not specify whether independence from host connectivity was an intentional design choice or a consequence of component availability.

The investigation is ongoing with competent authorities. Information is based on convergent reporting with known limits: only one structured independent primary source (Tibane Labs) has physically analyzed the implant, while Ledger's official confirmations concern a single verified device to date.

Sources: BleepingComputer, Help Net Security, The Hacker News, Crypto.news, CoinDesk

Information has been verified against cited sources and updated at time of publication.

Sources

Sources and references

Get DeafLetter