Ledger has confirmed the discovery of implants (hardware add-ons) embedded in Ledger Nano X hardware wallets sold through unofficial suppliers. The primary victims were customers who purchased through the reseller CryptoBilis, operating in Malaysia, Indonesia, and the Philippines. It is believed that the identified implant was used to steal funds from 324 cryptocurrency wallets amounting to approximately $102 million.
Researchers examined three types of implants integrated into devices purchased through Amazon Japan and Yahoo! Auctions from a Chinese seller who shipped orders from Malaysia. The implants utilized the ST STM32G431KBU6 microcontroller (ARM Cortex‑M4, 128 KB Flash), an LTE modem, and eSIM, connected to the SPI bus to intercept button press information and data displayed on the built-in OLED screen. The intercepted information was sent to the attackers via the cellular network and included the secret seed phrase input by the user during recovery or generated during the initialization of a new wallet.
In the first and second variants, the battery was replaced to accommodate the additional board, while in the third variant, the original battery was retained, and the chip was placed in the recesses of the foam gasket beneath the screen. In the first variant, the modification was immediately noticeable due to the abundance of extra wires.
The second variant involved a board connected via a flexible ribbon cable soldered to the factory outputs on the original board.
In the third variant, a specifically designed overlay printed circuit board, mass-produced to order, was used instead of a homemade one. The only visible sign remained the antenna wire, while the implant board was placed flush against the original Ledger board and visually blended with it. The markings on the microchips were ground off.
The implantation of the implants was carried out at one of the stages of the supply chain without compromising Ledger's infrastructure. Since the modification does not affect the original Ledger chip, the standard authenticity check does not allow for the detection of the implant.
Users who have purchased hardware cryptocurrency wallets through CryptoBilis in the last three months are advised not to initialize new devices or transfer funds to a new wallet by regenerating the seed phrase. To prevent similar incidents in the future, Ledger plans to implement additional anti-tampering measures. CryptoBilis, which changed ownership in March 2026, has suspended sales of hardware cryptocurrency wallets until the investigation is complete.
Source: opennet.ru
