Ledger Hardware Wallets Really Were Tampered With! Company Confirms Devices Were Implanted; Suspected Theft Rises to $93.2 Million

The Ledger hardware wallet theft incident in Southeast Asia has escalated further.
On October 11, Ledger confirmed that, while investigating a case involving assets stolen after devices were purchased through Southeast Asian reseller CryptoBilis, it had discovered an “unauthorized hardware implant” in the hardware wallet of at least one affected user. This is the first time Ledger has officially confirmed physical hardware tampering in an affected device since the incident came to light.
Meanwhile, after retracing the relevant addresses, blockchain analytics firm Bitquery estimates that the suspected theft has grown to approximately $93.2 million, involving 315 wallets across multiple blockchains, including Bitcoin, Ethereum, Tron, BNB Chain, and Polygon.
However, the $93.2 million figure is currently based on third-party on-chain analysis and is not an officially confirmed loss figure from Ledger.
Ledger confirms for the first time: hardware was added to an affected device
The most important new development in this incident is that physical tampering is no longer just speculation. Ledger said that additional unauthorized hardware components were indeed found inside a device belonging to an affected user. The company is continuing to contact other potentially affected users and is working with law enforcement and cybersecurity teams on the investigation.
Ledger also emphasized that there is currently no evidence that Ledger’s own security infrastructure, systems, or services were compromised. At this stage, the incident appears to involve supply-chain or physical device tampering, rather than a remote breach of Ledger’s servers, firmware, or Secure Element security chip.
Tibane Labs’ technical teardown of the Ledger Nano X implant revealed a highly sophisticated attack method. The researchers found that the attackers did not try to crack Ledger’s most important security component, the Secure Element. Instead, they added a miniature circuit board inside a genuine Ledger device to directly monitor the data lines between the Secure Element and the OLED screen.
When users set up a hardware wallet for the first time, Ledger displays a 24-word recovery phrase on the screen. An implanted device can read the pixel data sent to the screen, identify the 24 English words, and transmit the recovery phrase to the attackers using its own LTE mobile network module, SIM card, and antenna. Once the attackers have the complete recovery phrase, they can restore the same wallet on another device without ever needing to touch the victim’s Ledger again.
Genuine Check may still pass
The most troubling aspect of this attack is that the modified device may still be a genuine Ledger.
Tibane Labs said the implant does not modify Ledger’s Secure Element, so the original security chip can still prove to Ledger Live that it is genuine. In other words, a user may receive a genuine Ledger Nano X, and the official Genuine Check may show that it is authentic, even though additional surveillance hardware has been soldered inside the device.
This is entirely different from the traditional scenario of “buying a fake Ledger.” The real risk is a genuine device that has had malicious hardware added to it somewhere along the supply chain.
The attack technique has evolved through at least three generations. Tibane Labs’ investigation also shows that these implants are not a one-off, crude modification. Researchers have identified at least three generations of implant designs. The earliest, first-generation devices still used extensive hand-soldered wiring and even required the original Ledger battery to be made smaller to fit the implant board.
In newer versions, the attackers switched to custom flexible printed circuit boards (flex PCBs), shaped to fit the original test points on the Ledger Nano X, and added dedicated mobile network chips, an eSIM, and a custom antenna. Some components were even painted to match the color of Ledger’s original motherboard, and the chip model numbers had been ground off.
Tibane Labs believes this design looks less like an individual hacker’s experiment and more like an attack backed by funding and engineering expertise, with the intention to manufacture on a large scale.
Suspected theft rises to $93.2 million
Bitquery’s latest investigation has further expanded the suspected victim pool. As of October 11, Bitquery said it had tracked about $93.2 million in assets suspected of being stolen, involving 315 wallets across six blockchains. Assets in the Tron ecosystem still account for the largest share, while substantial amounts of Bitcoin and Ethereum have also been transferred.
Bitquery also tracked some of the stolen assets as they subsequently moved through Tornado Cash, Zcash, and other exchange channels. The research team said that, as of its latest update, another 1,736 ETH had been sent through Tornado Cash and Zcash. Some assets were eventually converted to USDC, and Bitquery believes about $5.35 million in USDC is held at addresses where Circle may still be able to freeze it.
However, the above is still based on on-chain attribution analysis. Ledger has not confirmed that all 315 wallets were victims of the same incident, nor has it officially confirmed the total of $93.2 million.
The incident has also prompted intervention from a stablecoin issuer. Earlier on-chain investigations showed that Tether had frozen about $10 million in USDT linked to addresses associated with the suspected theft.
This is also an important difference between centralized stablecoins and native crypto assets such as BTC and ETH. USDT and USDC issuers can freeze tokens at specific addresses by blacklisting them, but once attackers control and successfully transfer Bitcoin or native ETH, recovery is usually more difficult.
CryptoBilis has halted sales of all hardware wallets
When the incident first came to light, Ledger only asked CryptoBilis to suspend sales and shipments of Ledger products. Ledger has now said that CryptoBilis has gone further and stopped selling all hardware wallet inventory until the investigation becomes clearer.
This has drawn particular attention from the market because CryptoBilis was not just an unknown online seller; it was one of Ledger’s official sales channels in Malaysia, Indonesia, and the Philippines. So if it is ultimately confirmed that the implants entered the official retail supply chain, the impact would extend beyond Ledger to challenge the “authorized resellers are safer” trust model on which the entire hardware wallet industry has long relied.
Ledger further said that all confirmed cases of assets being drained so far involved devices sold through CryptoBilis, while no similar issues have been found in Ledger’s direct sales channel. This information further focuses the investigation on a specific supply chain rather than Ledger’s global product line.
Ledger remains highly vigilant about devices recently purchased from CryptoBilis. If a device has not yet been set up, Ledger advises users not to initialize it. If it has already been set up and assets have been stored on it, users should consider transferring those assets to a trusted new hardware wallet and must create a completely new recovery phrase. Simply replacing the hardware while continuing to use the old 24-word recovery phrase will not solve the problem. If the recovery phrase was ever displayed on the screen of an implanted device, users must assume it may have been exposed.
This article, “Ledger hardware wallets really were tampered with! Company confirms device implants as suspected theft rises to $93.2 million,” was originally published on Blockcast.