Ledger confirms CryptoBilis wallet implants; theft totals disputed

Ledger confirmed implants in some CryptoBilis-sold Nano X wallets that stole seeds; loss estimates range from over $86 million to about $100 million.

Ledger confirmed unauthorized hardware implants in some Nano X wallets sold by Malaysian reseller CryptoBilis after cryptocurrency theft reports, including an October 9 draining incident, and said confirmed cases involved that reseller rather than Ledger’s systems or direct sales. Loss totals disagree: The Hacker News and Cyber Security News cited investigator estimates above $86 million that Ledger has not confirmed, while Help Net Security reported suspected losses exceeding $93 million and a later account linked more than 300 wallets to about $93 million, with broader estimates near $100 million and some proceeds through mixers. Researchers Mark Karpelès and Tibane Labs described implants that reconstructed the seed from the display and button presses and sent it over LTE using an eSIM; designs included a smaller battery with an STM32G431KBU6 and an under-OLED factory flex PCB, while a later report added series-produced third-generation implants that leave the original battery and intercept seed characters on the way to the screen without altering the Secure Element. Cyber Security News said Ledger itself had not explained how the implant worked, and outlets differ on whether the company verified one device or some wallets, though Ledger called the volume limited. Ledger said Genuine Check cannot detect added implants when the Secure Element is intact, paused CryptoBilis sales, and told recent buyers not to set up unused devices and to migrate funds to a new seed; CryptoBilis stopped hardware-wallet sales and warned that a pre-printed recovery phrase makes a wallet unsafe. Bitquery data cited by Help Net Security indicated more than 80% of drained wallets were first funded in June or later, suggesting impact beyond the 90-day window.

• Ledger confirmed unauthorized hardware implants in some Ledger Nano X wallets sold by Malaysia-based reseller CryptoBilis (also spelled Cryptobilis); confirmed cases were tied to that channel, including an October 9 draining incident, not…
• Loss figures disagree and Ledger has not confirmed them: investigator estimates above $86 million; Help Net Security and later observers about or above $93 million across more than 300 wallets; broader estimates near $100 million, with…
• Researchers including Mark Karpelès and Tibane Labs said implants captured the displayed seed and button presses, then exfiltrated over LTE via an eSIM; one design used a smaller battery and an STM32G431KBU6, another sat under the OLED on…
• A later report said third-generation, series-produced implants leave the original battery and read seed characters on the path to the screen; the Secure Element was not altered, and Ledger previously had not explained the mechanism.
• Genuine Check cannot detect added implants if the Secure Element is intact; affected devices reportedly passed Genuine Check and arrived in intact shrink wrap.
• Ledger paused CryptoBilis sales, called the affected volume limited, and told buyers from the last 90 days or three months not to initialize unused devices and to move assets to a new seed; CryptoBilis halted hardware-wallet sales and…
• Help Net Security, citing Bitquery, said more than 80% of drained wallets were first funded in June or later, which may extend beyond Ledger’s 90-day advisory window.