Hidden implant in Ledger hardware wallets linked to $93M theft

Three days after customers in Southeast Asia began reporting drained wallets, Ledger says the damage is limited. In its 72-hour update on X on October 11, the Paris-based hardware wallet maker said “all confirmed cases related to the disclosed draining incident of Oct 9th, 2026, involve devices sold through the Southeast Asia reseller CryptoBilis.”

On-chain researchers put suspected losses at more than $93 million. Ledger said its own systems and direct sales channels were not compromised.

The wallet maker has yet to comment on the unverified claim made by an X user that Ledger’s hardware wallets sold in Europe via official reseller Mediamarkt might have been similarly tampered with and compromised.

How the implant allegedly works

Ledger has confirmed that one affected device contained an unauthorized hardware implant, but it has not said how the implant works. The most detailed account so far comes from former Mt. Gox CEO Mark Karpelès, who says he bought a tampered Ledger in Malaysia.

Photos and videos Karpelès posted on X appear to show a small circuit board hidden under the device’s screen, where the display’s padding would normally sit.

He says the board carries a microcontroller, an antenna, an LTE chip and an e-SIM card, and that “the implant just monitors what’s shown on the screen, will take note of the seed [phrase] as it’s shown to you, then transmit it [to the attacker].”

With the recovery phrase in hand, an attacker can rebuild the wallet on any device and empty it whenever they choose, without ever touching the original hardware. That would let them collect phrases quietly and strike all at once, which fits the wave of drains reported on October 9.

The implant is also hard to spot. Karpelès says his device arrived in intact shrink wrap and passed Ledger’s Genuine Check, because the security chip inside is real. He says the only reliable way to find the extra circuit board is to open the device.

Investigation ongoing, users urged to switch devices

On Sunday, Ledger confirmed said it is working with the relevant authoritiesb and that it is reaching out to impacted users.

“We encourage impacted users to reach out to Ledger Support through official channels and file complaints with their local law enforcement authorities,” the company advised.

It also urged customers who bought their Ledger wallet from CryptoBilis to refrain from initializing the device (if they haven’t already). Those who have already set one up should move assets to a new device (presumably bought directly from Ledger), with a new seed.

“Ledger’s advice covers people who bought from the reseller in the last 90 days,” blockchain data and analytics company Bitquery noted. But more than eight in ten of the drained wallets it traced first received funds in June or later, which suggests devices bought from CryptoBilis since June may also be compromised.

“CryptoBilis has confirmed having ceased all sales of hardware wallets. We are reminding our authorized resellers and distributors to source products only through authorized channels and never to restock returned products,” Ledger added, and advised users not to purchase from unauthorized resellers.

Unfortunately, the incident shows that buying from an authorized reseller is no guarantee.

As the situation unfolds, Ledger also noted that scammers might take advantage of the incident to reach out to users and try to trick them into sharing their seed phrase.

“Rely only on official Ledger channels. Ledger will never call you, DM you, or ask for your 24-word recovery phrase,” the company concluded.

Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!