A hidden implant inside a Ledger wallet let attackers grab recovery phrases and empty user accounts, slipping past the device's authenticity check. Investigators now peg crypto losses at over $93 million across several blockchains.
One customer's missing funds set off the alarm. When investigators cracked open the Ledger hardware wallet, they found a physical implant tucked inside-a device built to intercept recovery phrases and quietly siphon crypto. Ledger confirmed the breach after examining the tampered unit, exposing a blind spot in its Genuine Check system. That check verifies the secure element's authenticity, but it can't spot clever hardware tweaks if the chip itself stays untouched.
Implant Mechanism
Researchers at Tibane Labs and hardware hacker Joe Grand have tracked two generations of Ledger Nano X implants. The implants tap into the electronic signals running between the secure element and the display. During setup, when the wallet spits out a 24-word recovery phrase, the implant's microcontroller reads the screen data, rebuilds the phrase, and beams it out using a cellular modem. Attackers then get remote access to the victim's wallet, no need to touch the secure chip or the device again.
The implant intercepts unencrypted display signals, allowing attackers to exfiltrate seed phrases without breaching the device's Secure Element.
Early versions of the implant used visible wires and smaller batteries to squeeze in the extra electronics. The latest version, examined in September, hid a custom circuit board under the screen, packed in an LTE modem and antenna, and kept the original battery. Even opening the case might not tip off most users to the tampering.
Scope of Losses
Losses have piled up fast. Alex Thorn at Galaxy Digital reported $91 million stolen from 477 addresses on Bitcoin, Ethereum-linked networks, and Tron. Tron wallets took the biggest hit-$64.5 million, including 64.3 million USDT. Bitcoin losses reached $17.7 million, with Ethereum and related networks at $8.8 million. Bitquery, running its own analysis, found $93.2 million missing from 315 wallets across six blockchains. The two groups used different address sets and methods, and neither can pin down exactly how many devices were tampered with.
Bitquery's data shows attackers moved in sync on October 9. Twenty-five Tron wallets signed the same token approval within three seconds, letting $29 million in USDT vanish almost instantly. Small test transactions in the weeks before the main thefts point to a period of dry runs before the coordinated strike.
Ledger confirmed it is investigating thefts affecting users in Southeast Asia who purchased devices from reseller CryptoBilis, but stated its infrastructure and services remain uncompromised. The company has requested CryptoBilis suspend sales and deliveries while the probe continues.
Supply Chain and User Impact
The probe started after users lost funds following purchases from CryptoBilis, an authorized Ledger reseller in Southeast Asia. CryptoBilis has now halted all wallet sales while the investigation runs. Ledger hasn't said how many devices were altered or if the implant caused every reported theft. The company insists its own security systems and infrastructure are still intact.
Only one confirmed device carried the implant, so not every theft can be traced to this method or to CryptoBilis. Some implant samples published by researchers didn't come from CryptoBilis, and no public evidence links those samples to the stolen funds. That leaves open questions about whether a single group or a wider supply chain breach is at play.
Ledger's own documentation admits the Genuine Check can't spot unauthorized physical changes if the secure element is left alone. The company is reaching out to affected users, working with law enforcement, and building tougher anti-tampering features. Customers who bought from CryptoBilis are told not to initialize unused wallets. Anyone who already set up a device should move funds to a new wallet with a fresh recovery phrase on trusted hardware.
Industry Response and Security Lessons
CryptoQuant's Darkfost and others warn that other regional resellers could face similar risks, though there's no hard proof of a broader supply chain breach. Tether has frozen $10 million in stolen USDT, and Circle could freeze $5.35 million in USDC after funds moved through privacy tools like Tornado Cash and Zcash. The attack has put a spotlight on the limits of hardware wallet authenticity checks and the dangers of relying only on device-based verification.
The scale of this theft matches other headline crypto heists, including the Bybit incident reported earlier, where attackers exploited exchange infrastructure. In both cases, attackers moved fast and left users with no way to recover funds once credentials leaked.
Ledger's moves-halting sales through CryptoBilis, contacting users, and promising stronger anti-tampering-show that chip-level checks alone don't cut it. Even trusted self-custody hardware is only as safe as its supply chain and physical build. For users, buying from trusted sources and generating new recovery phrases on verified devices is essential. The industry faces the hard fact that physical tampering can slip past digital safeguards, and user caution is the last defense.
Hardware wallets keep private keys offline, but they can't block every physical attack. The secure element in a Ledger Nano X is built to resist digital hacks, but if an attacker grabs the recovery phrase as it appears on the screen, the whole security model falls apart. Authenticity checks that focus only on the chip miss the risk when the device's physical shell is compromised. Any recovery phrase generated on a suspect device should be treated as exposed, and funds should be moved to a new wallet with a fresh phrase if tampering is suspected.
