Ledger confirms hardware wallet spy implant behind crypto thefts
Ledger confirmed spy implants in CryptoBilis-sold Nano X wallets captured seed phrases and drained users' cryptocurrency.
Ledger confirmed that some hardware wallets sold by Malaysia-based reseller CryptoBilis contained unauthorized spy implants that drained cryptocurrency. Researchers, including Mark Karpelès and Tibane Labs, found Ledger Nano X variants whose implants captured display output and button presses to reconstruct the seed phrase, then sent it over LTE using an eSIM. One design replaced the battery with a smaller cell and an STM32G431KBU6; a more advanced variant fit under the OLED and used a factory flex PCB. Ledger called the affected volume limited, told buyers not to set up those devices or to move funds to a new seed, and said its Genuine Check cannot detect added implants when the Secure Element is intact.