Researchers have traced roughly $91 million in stolen crypto to a hardware implant that beat Ledger’s own authenticity check, not by breaking any cryptography, but by reading a recovery phrase straight off the device’s screen during setup and radioing it out before the owner ever moved a coin. That distinction matters for anyone who treats a passed Ledger Genuine Check as proof a device is safe: in this case, it wasn’t.

Ledger began investigating on Oct. 9 after users in Southeast Asia who bought devices through CryptoBilis, listed on Ledger’s own site as an authorized reseller for Indonesia, Malaysia and the Philippines, reported losses. The next day, Ledger confirmed that one of the affected devices “contained an unauthorized hardware implant,” and by Tuesday it had described the mechanism in detail.

Key Takeaways

  • Galaxy Research counts about $91 million moved from 474 victim addresses across bitcoin, Ethereum, Arbitrum, Polygon and TRON; other trackers that also include BNB Chain put the total at $93 million to $95 million.
  • The implant sits inside the enclosure, reads the 24-word recovery phrase off the screen during setup, and sends it out over LTE through a provisioned eSIM, leaving the Secure Element untouched so Ledger’s Genuine Check still passes.
  • Roughly 88% of the stolen value, about $80 million, moved in a single hour starting 05:00 UTC on Oct. 9, the morning of Ledger’s first public statement.
  • About $56.6 million remained in attacker-controlled wallets as of Oct. 15, and Tether has frozen $10 million in USDT tied to the theft.
  • Every confirmed case traces back to devices sold through CryptoBilis, which has suspended hardware sales; Ledger says its own systems and direct sales channels were not compromised.

How the Implant Defeats Ledger’s Genuine Check

The tampering works around the wallet’s security, not through it. According to Galaxy Research, a separate component hidden inside the device reads the screen during setup, captures the 24-word recovery phrase, and transmits it over LTE via a provisioned eSIM. Because the Secure Element and Ledger’s own operating system are never touched, a tampered unit passes Genuine Check, the verification step self-custody users rely on to confirm their hardware hasn’t been altered. Independent teardowns cited by Galaxy found at least three generations of the implant, with the newest built as a professionally fabricated flex circuit concealed under the display.

The tampering appears to have entered the supply chain through returns rather than manufacturing. Ledger told Analytics Insight that criminals purchased genuine wallets, fitted them with the concealed components, and returned them into distribution, where they were resold as new. CertiK’s Esme Pau, quoted in that report, said “real-world security depends on the entire process,” pointing to the gap between a device’s cryptography and the physical path it travels before reaching a buyer.

Reports of similar tampering have surfaced outside CryptoBilis’s territory, though Ledger has not confirmed a broader pattern. Ben Yorke, who bought a Ledger Flex at Singapore’s Changi Airport, noticed marks suggesting the device had been opened and sent it to researcher Mark Karpelès, who found a connector attached to the display and cellular hardware, according to Analytics Insight. Karpelès told Bloomberg, as relayed in that report, “this is the kind of scale you see in spy movies.” A separate report involving a device in Germany prompted Ledger to suspend retail sales there as well.

The Money Trail

Onchain activity shows a coordinated harvest rather than scattered individual thefts. Galaxy’s tally splits the roughly $91 million into about $64.5 million in USDT and TRX from 146 TRON addresses, 213 BTC (about $17.6 million) from 279 bitcoin addresses, and $8.8 million in ETH and stablecoins from 49 Ethereum-type addresses. Bitcoin sweeps began Oct. 7, but the bulk of the value, about $80 million, moved in one hour starting 05:00 UTC on Oct. 9. Nearly all of the bitcoin victim addresses had never spent before, consistent with cold storage holdings, most funded within the prior 90 days though some dating to 2021, which Galaxy says fits a pattern of existing seeds being restored onto tampered devices.

Other trackers reach broadly similar but not identical totals, a gap outlets attribute to differing address sets and methodology rather than contradictory findings. Cryptonews reports Bitquery estimated about $93.2 million across 315 wallets and YFarmX put the figure at $94.5 million, while Galaxy’s own count, described there as a floor, covers roughly 477 addresses. Investing.com corroborated the broad contours, describing it as a hardware attack linked to a theft above $90 million.

As of Oct. 15, about $56.6 million sat untouched in attacker-controlled addresses, per Galaxy: roughly 208 BTC, about 12,800 ETH (much of it bridged from TRON), and 7.5 million USDT in TRON relay accounts created the morning of the drain. Roughly 5,400 ETH, about $13.5 million, has passed through Tornado Cash, and around $2 million reached exchange deposit addresses. Tether has frozen $10 million in USDT tied to the theft, and Cryptonews reports a further $5.35 million in USDC could potentially be frozen, though that is not confirmed as recovered. At least one victim has resorted to messaging the attackers onchain, offering a cut of the funds in exchange for returning the rest.

What to Watch

Ledger has asked distributors across Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to pause sales while it reviews devices, and it has tightened rules barring counter or shelf display of units and resale of returned products, according to Cryptonews. Trezor said it found no evidence of tampering in its own devices but dropped CryptoBilis as a reseller as a precaution. Whether the Singapore and Germany reports represent a wider pattern beyond CryptoBilis, and how much of the $56.6 million still sitting in attacker wallets ultimately gets frozen or moved, remain open questions tied directly to Ledger’s ongoing investigation.

Sources