Ledger has confirmed an unauthorized hardware implant in one affected customer's wallet, as investigators estimate that roughly $93.2 million in suspected cryptocurrency thefts are tied to tampered devices sold through a Southeast Asian reseller. The company said it found no indication that its own security infrastructure, systems or services were compromised.
CryptoBilis, an authorized reseller based in the region, has suspended sales of all hardware wallet inventory pending the conclusion of the investigation.
What Tibane Labs found inside the devices
The investigation began after customers reported losing crypto after buying Ledger devices from the reseller. Tibane Labs documented three generations of Ledger Nano X implants designed to intercept recovery phrases, combining Joe Grand's teardown of an earlier implant with two specimens examined in September.
The implants work by monitoring electronic signals sent between a wallet's secure element and its display. From those signals, attackers can reconstruct the 24-word recovery phrase and transmit it over a cellular modem — no physical theft required, and no compromise of Ledger's secure chip.
The most advanced version Tibane examined contained a custom circuit board hidden under the screen, with an LTE modem, an antenna, and components whose identifying markings had been removed. It preserved the original battery and could pass visual inspection even after the casing was opened, according to the lab.
Tibane's two specimens were bought through Japanese marketplaces rather than from CryptoBilis. The lab also issued a blunt warning: any recovery phrase displayed on a compromised device should be treated as exposed, and funds should be moved to a wallet with a new phrase generated on a trusted device.
Why Genuine Check doesn't catch it
Ledger's Genuine Check verifies the secure element's authenticity. It cannot detect unauthorized physical modifications, such as spying implants, if that element remains intact. That gap is central to the case: a device can pass the check and still be compromised.
Ledger has not said how many devices were modified, and it has not established that the implant caused all the reported losses. The company said it is contacting affected users and coordinating with authorities.
Two estimates, two methods, same scale
Galaxy Digital research executive Alex Thorn reported approximately $91 million across 477 addresses on Bitcoin, Ethereum-related networks and Tron. Thorn attributed $64.5 million of the suspected thefts to Tron, including roughly 64.3 million USDT. Bitcoin accounted for $17.7 million, or about 213 BTC. Ethereum and related networks contributed $8.8 million.
Bitquery counted approximately $93.2 million from 315 wallets across six blockchains. The two estimates use different address sets and methods, and neither counts the number of tampered devices.
Bitquery identified transaction patterns suggesting attackers obtained control of multiple wallets before a coordinated withdrawal on Oct. 9. Twenty-five Tron wallets signed the same token approval within three seconds, allowing roughly $29 million in USDT to be withdrawn within moments. Small test transactions were conducted over about two weeks before the larger thefts, suggesting preparations were underway well before users reported missing funds.
Bitquery estimated that Tether had frozen approximately $10 million in stolen USDT. It also identified $5.35 million in USDC that issuer Circle could freeze after funds moved through Tornado Cash and Zcash.
The reseller question
CryptoQuant analyst Darkfost suggested examining other regional resellers for possible supply-chain exposure, while acknowledging the concern was speculative and unsupported by confirmed evidence. CryptoBilis has not said when it might resume sales.
For now, the concrete facts remain narrow: one confirmed implant, a suspended reseller, and two independent estimates that agree on scale but not on addresses. Ledger has not explained how the modified devices reached customers, and no timeline has been given for the investigation's conclusion.
