Ledger confirmed that at least one device tied to an ongoing wallet-drain investigation contained an unauthorized hardware implant. The discovery comes as estimated losses from the exploit reach $93 million across 311 wallets on five chains.
The affected customers bought their devices through CryptoBilis, a reseller serving Indonesia, Malaysia, and the Philippines. Ledger says its own systems and services show no sign of compromise, pointing instead toward a physical or reseller-side exposure rather than a backend breach.
What Karpelès found inside the device
Former Mt. Gox CEO Mark Karpelès began looking into the Ledger incident on October 9, 2026, after receiving a Ledger Nano X from Malaysia that was suspected of physical tampering. Despite intact shrink-wrap packaging, Karpelès discovered a hidden electronic module concealed behind the screen.
The module contained a microcontroller, LTE cellular hardware, an antenna, and an eSIM, with connections running to the device's display circuitry. Karpelès believes the setup could capture recovery phrases as they are displayed during wallet setup and transmit them over a cellular connection.
CryptoBilis points to a change in ownership
CryptoBilis' former co-founders, Arravind Prabu and Vimalatheethan, said they completed the sale of the company in March 2026 and handed over operational control. They claimed a confidentiality agreement prevented public announcement of the transaction until mid-October.
Corporate records cited by BitPinas reportedly show that 100% of CryptoBilis' shares were transferred to an individual identified as Jiaming on August 3, 2026. The registered address associated with the buyer was reportedly in Heilongjiang province, China.
There is currently no established evidence linking CryptoBilis' new owner to the alleged tampering.
Ledger tells reseller to pause all inventory sales
Ledger has asked CryptoBilis to stop selling all hardware-wallet inventory while the investigation continues — not just Ledger products. The company has also contacted affected users and says it is working with relevant authorities on the exploit.
Investigators have not established that the implant caused all the reported thefts. A separate community report alleged that a European MediaMarkt location was involved, though the details of that claim remain unverified.
What happens next
The central question now is how far the tampering goes. Ledger's request for a full sales halt at CryptoBilis suggests the company is treating the reseller's entire inventory as potentially compromised, not just the one device Karpelès opened. Whether other units from the same distribution channel carry similar implants is still unknown.
Karpelès' findings give investigators a concrete starting point, but the $93 million figure spans five chains and hundreds of wallets. Tying every one of those losses to a single hardware supply-chain compromise will take time.
