Tibane Labs (Organization): news timeline & CVEs

Ledger asks sellers across Asia to halt sales after supply-chain attack

Ledger halted Asia and Hong Kong reseller sales after tampered wallets stole seed phrases over LTE.

Ledger told distributors and resellers in Southeast Asia and Hong Kong to stop selling hardware wallets after confirming supply-chain tampering. Devices from reseller CryptoBilis contained a separate microcontroller implant that decodes the 24-word recovery phrase and transmits it over LTE using an eSIM, without modifying the Secure Element or Ledger OS. Ledger said confirmed fund losses involve CryptoBilis units, while users also reported modified devices from a Singapore airport retailer and MediaMarkt in Europe. Trezor said it found no compromise of its own devices but will end many reseller authorizations on January 1, 2027.

BleepingComputerOct 14, 17:46 UTC · 2d agoData breach in the wild1· 1 read

Risky Bulletin: Spyware chip found in Ledger crypto-wallets

Spy chips in Ledger Nano X wallets sold via CryptoBilis stole seed phrases and over $86 million.

Tibane Labs reported spy chips soldered into Ledger Nano X wallets sold by Southeast Asian reseller CryptoBilis, intercepting on-screen seed phrases and sending them to attackers over a built-in modem and eSIM. Ledger linked the backdoored devices to more than $86 million in stolen crypto and told customers to discard affected wallets and move funds; it paused work with CryptoBilis. Newer implants use a painted flex PCB, and at least one Ledger Flex bought at Singapore Airport was also reported implanted. The same bulletin also covers freezer tampering at French supermarkets including Intermarche, an Ahold Delhaize outage, and a Meta GitHub breach affecting more than 1,500 US employees.

Risky Business NewsOct 14, 03:02 UTC · 3d agoMalware in the wild2· 1 read

Crypto thieves sell hardware wallets with secret eSIM

Tampered Ledger Nano X wallets with hidden LTE modems stole seed phrases, draining about $93 million.

Criminals sold modified Ledger Nano X hardware wallets containing a chip that intercepts seed phrases displayed from the Secure Element, plus an LTE modem, eSIM, and antenna that transmit them. The Secure Element itself was not altered. Blockchain observers identified more than 300 drained wallets totaling about $93 million, with broader loss estimates near $100 million, and some proceeds passed through mixers. Tibane Labs described professionally manufactured implants; Ledger warned customers who bought from Malaysian dealer Cryptobilis in the last three months not to use those devices.

Hacker News · AIOct 13, 08:34 UTC · 3d agoPhishing & fraud in the wild 5 sources HN 110↑ · 2 comments1

Ledger confirms hardware wallet spy implant behind crypto thefts

Ledger confirmed spy implants in CryptoBilis-sold Nano X wallets captured seed phrases and drained users' cryptocurrency.

Ledger confirmed that some hardware wallets sold by Malaysia-based reseller CryptoBilis contained unauthorized spy implants that drained cryptocurrency. Researchers, including Mark Karpelès and Tibane Labs, found Ledger Nano X variants whose implants captured display output and button presses to reconstruct the seed phrase, then sent it over LTE using an eSIM. One design replaced the battery with a smaller cell and an STM32G431KBU6; a more advanced variant fit under the OLED and used a factory flex PCB. Ledger called the affected volume limited, told buyers not to set up those devices or to move funds to a new seed, and said its Genuine Check cannot detect added implants when the Secure Element is intact.

BleepingComputerupdated Oct 13, 08:34 UTC · 3d agofirst Oct 12, 16:27 UTC · 4d agoData breach in the wild 5 sources

Tibane Labs

Timeline4 articles

Appears with

Ledger asks sellers across Asia to halt sales after supply-chain attack

Risky Bulletin: Spyware chip found in Ledger crypto-wallets

Crypto thieves sell hardware wallets with secret eSIM

Ledger confirms hardware wallet spy implant behind crypto thefts