Ledger confirms implant in wallet sold by reseller: the device was genuine, passed the Genuine Check, and still gave up the seed

On 9 October, Ledger asked CryptoBilis — listed as an official reseller in Malaysia, Indonesia and the Philippines — to halt sales and shipments of its devices. The guidance to anyone who bought there in the last 90 days was blunt: if you haven't set the wallet up, don't; if you have, move the assets to a new signer with a new recovery phrase. The following day brought the missing confirmation: one of the victims' devices contained an unauthorised hardware implant. CryptoBilis stopped selling its entire hardware wallet inventory pending the investigation, and Ledger says it is working with law enforcement and with the SEAL 911 incident response group.

The manufacturer maintains that its infrastructure, systems and services were not compromised, and that the case, as far as is known, is confined to this one reseller. Neither claim answers the question that matters to anyone with a cold wallet at home: how does a genuine, sealed device that passes the manufacturer's own check hand over the key?

How much left, and whose number is whose

Three figures circulated the same day, from different sources. On-chain researcher tanuki42 put it at more than $72 million; Specter said more than $86 million "from hundreds of wallets", then walked back the victim count. The only tally with a stated method comes from Bitquery, which started from the ten addresses the two had published, traced every inflow and outflow across six networks, and reran the figures in an independent second pass: $93.2 million, from 315 wallets. It counts only what left a victim's wallet; internal thief-side movements, swaps and fake tokens are excluded. Ledger has confirmed no figure.

The breakdown shows where the money sat. TRON accounts for $70.5 million across 131 wallets, almost all of it USDT. Bitcoin follows, with 203.8 BTC ($16.8 million) from 122 wallets. Ethereum, BNB Chain, Polygon and Solana make up the rest. A wallet is not a person: one owner may hold several.

The timeline shows preparation. The thief's control addresses on TRON and Ethereum received their first funds on 25 September, three minutes apart. Between 26 September and 7 October there were 41 test loops of the kind that fund a wallet with a few dollars, approve a spend and pull it back. In the early hours of 9 October, at 04:59 UTC, a new key was added to 30 TRON wallets in three seconds, stripping the owner of the ability to act alone. At 05:07 UTC, 25 wallets signed the same approval in six seconds. At 05:54 UTC, 111 Bitcoin wallets were emptied in a single block.

Tether began blacklisting addresses ten minutes after the first public post and reached 37 within two hours. Twenty of them still hold roughly $500,000 each — $10 million frozen in place. Another $10 million was already in USDD, a stablecoin Tether cannot freeze. What a freeze reaches, and what it does not give back, is something we covered when Tether blacklisted USDT from another scam.

The implant reads the screen, not the chip

The mechanism is nothing new to anyone who follows hardware security. In May, researcher Joe Grand presented at the hardwear.io conference in California his reverse engineering of an implant found inside a Ledger Nano X. His first contact with the case was a Reddit report in August 2025. What he found: the original battery swapped for a smaller one to free up space; an unmarked ARM microcontroller wired into the SPI bus connecting the Secure Element to the OLED screen; a 4G cellular modem and a data eSIM. The implant's firmware stores the glyphs for the letters a through z, watches what the secure chip sends to the display, recognises the recovery-phrase words as they appear during setup, writes the phrase to memory and transmits it over the cellular network. The eSIM belonged to a Dutch carrier, data-only, and carried connection records in the Philippines.

Grand closed the talk with a warning: newer iterations of the implant had already been seen. On 16 September, three weeks before the theft, former Mt. Gox CEO Mark Karpelès posted a photo of a more recent version alongside the older one and wrote that the evolution was substantial. On 9 October he said his device had come from Malaysia with the shrink wrap intact, and that the implant sits where the filler behind the screen should be — invisible even with the case open. Ledger has confirmed the implant's presence in one victim's device; it has not publicly confirmed that Karpelès's unit came from CryptoBilis, nor that all 315 wallets fell the same way.

Why the genuine-device check passes

The check Ledger runs on first use and on every connection tests one thing: whether the Secure Element can prove, using a key burned in at the factory, that Ledger manufactured it. It is a proof about the chip. The implant never touches the chip. It sits outside, on the line carrying the screen's contents — and the screen is precisely the one place where the recovery phrase appears in plain text.

The manufacturer says so in as many words. Its hardware integrity support page, updated on 13 May, states that the check "cannot detect unauthorized physical hardware modifications, such as spy implants, if the original Secure Element remains intact". The same page publishes board photos for each model so users can compare the inside of their device against the original, and warns that opening the wallet voids the warranty. The purchasing advice is unchanged: official store or a reseller from the list.

Outside Asia, reports only so far

On 11 October, a user posted photos of a device he says he bought weeks earlier from an official reseller's shop in Europe, carrying cables that don't exist in the original. Karpelès assessed the images as an earlier version of the same implant. It is a third-party account, unconfirmed by Ledger or any independent lab, and the author himself notes that the wallet in question never sent funds to any of the thief's addresses. Treat it as what it is: a signal worth watching, not an established fact.

Why this matters for readers in Brazil

Two points. The first is that the previous Ledger attack to make the Brazilian press, back in April, was a different vector: a researcher who identifies as Brazilian dismantled a Nano S+ bought on a Chinese marketplace and found an ordinary chip in place of the Secure Element, firmware from a version that doesn't exist, and the phrase and PIN stored in plain text and shipped to a command-and-control server. That was outright counterfeiting — the kind the genuine-device check does catch. This case is the inverse: a genuine device with a stowaway. What both have in common is that the manufacturer's check answers a narrow question, and intact packaging answers none at all.

The second is that anyone buying a Ledger in Brazil buys through a reseller. The official list names four for the country, plus the brand's own storefront on Amazon Brasil. CryptoBilis was still listed as an official reseller on 11 October, two days after the suspension request. We found no reports of Brazilian victims.

For anyone holding a cold wallet not bought direct from the manufacturer, the path is the one Ledger itself points to: compare the interior against the official photos, knowing that opening it voids the warranty. No legitimate device arrives with a recovery phrase or PIN already set; if yours did, use neither the phrase nor the device. Anyone who has already lost funds can file the case with SEAL 911, contact Tether if the asset was USDT, and look up the address that received the money to see whether it has already been flagged. In September, a third-party security product was the vector for the Bitget attack; here, it was the distribution link. In both cases, what failed wasn't the lock — it was whoever handed it over.

In one line

The genuine-device check proves the chip is Ledger's; the implant doesn't need the chip, it needs the screen — and the screen is where the recovery phrase appears.

Sources

• Ledger Support, on X — statement of 9 October 2026 and 10 October update confirming the implant
• Ledger — Check hardware integrity (support page, updated 13/05/2026) and Best practices to securely buy a Ledger signer (Ledger Academy, updated 18/09/2026)
• Ledger — Authorised resellers (accessed 11/10/2026)
• Bitquery — Ledger CryptoBilis Hack: $92.9M Drained, Where It Went (updated 11/10/2026)
• Joe Grand, Grand Idea Studio — Reverse Engineering a Ledger Nano X Hardware Implant (hardwear.io USA 2026; slides revised 29/05/2026)
• Mark Karpelès, on X — post of 16 September 2026 and post of 9 October 2026
• The Block — Ledger investigates wallet drains involving CryptoBilis buyers (09/10/2026)
• Cointelegraph — Ledger warns CryptoBilis buyers amid crypto loss reports (09/10/2026)
• Exame — Brasileiro descobre esquema de venda de carteiras cripto falsificadas que roubam senhas (17/04/2026) and Livecoins — Pesquisador brasileiro descobre esquema de falsificação de carteiras físicas da Ledger (17/04/2026)
• CyberX — Tether can freeze USDT. What that changes for people who lost money and The attack that took $387.5 million from Bitget came in through a security product