Ledger has confirmed that a hardware wallet sold through reseller CryptoBilis contained a hidden implant, part of a tampering campaign tied to roughly $93 million in reported thefts. The company says its own systems remain uncompromised, though the affected device reached its buyer through a sales channel Ledger lists for Southeast Asia.
The discovery was made by Mark Karpelès, the former Mt. Gox CEO, who found a spy chip inside a sealed Nano X he bought in Malaysia. According to Karpelès, the chip read his recovery phrase off the screen and transmitted it over a cellular connection.
Inside the tampered Nano X
The implant didn't announce itself. In Karpelès' unit, a small board sat behind the screen, while a shorter battery freed up room inside the casing. The added weight came to about one gram. Ledger lists the Nano X at 34 grams; Trezor lists its Safe 3 at 14 grams, for comparison.
That one-gram difference matters because it falls within normal factory variance. As Karpelès pointed out, batteries of equal capacity can differ in weight by that much. A kitchen scale reading in one-gram steps can't separate a real implant gap from ordinary manufacturing drift. Precision micro scales do better, but only when calibrated against a reference weight.
The practical upshot: opening the casing remains the only direct way to inspect a hardware wallet board.
Ledger's response
Ledger paused reseller sales and urged recent CryptoBilis buyers to skip hardware wallet setup entirely. That's an unusually blunt instruction — telling customers not to initialize a device they just bought — but it's the only way to keep a compromised unit from generating seed phrases the attacker can use.
The company maintains that its own manufacturing and distribution systems weren't breached. The tampering, in this account, happened somewhere along the reseller path. CryptoBilis is listed by Ledger as a reseller for Southeast Asia, which is why the confirmation is awkward: the device reached the buyer through an official channel, not a gray-market stall.
Why a kitchen scale won't save you
Weight checks have become a popular home remedy for hardware wallet paranoia. The logic is simple enough — a tampered device carries extra components, so it should weigh more. But the Nano X case shows the limits of that approach.
A kitchen scale only catches a crude implant, not a careful one. The attacker in this case trimmed the battery and tucked the implant board behind the screen, keeping the total added mass down to roughly a gram. Karpelès' own assessment is that the difference sits inside normal variance, meaning a scale reading of 34 grams versus 35 grams proves almost nothing without a calibrated reference and micro-scale precision.
For most users, that's not a realistic test. Even if you own a micro scale, you'd need a known-good unit to compare against, and you'd need to trust that the reference itself wasn't tampered with.
The reseller question
Hardware wallet attacks have been moving from software into the device itself. Phishing sites and fake apps still work, but they require the user to make a mistake. A tampered wallet flips that — the user does everything right and still loses funds.
That shift puts new pressure on the supply chain. Buying directly from the manufacturer doesn't eliminate risk, but it removes at least one handoff where a sealed box can be opened, modified, and resealed. Ledger's decision to pause reseller sales reflects how seriously the company is treating that gap.
What happens next depends on the investigation into how the device was tampered with and where in the distribution chain the swap occurred. Ledger hasn't said when reseller sales will resume. For anyone who bought a Nano X through CryptoBilis recently, the company's advice stands: don't set it up.
