Ledger Blames CryptoBilis for $93M Theft After Finding LTE Implant in Wallets

Ledger has confirmed that hardware implants in wallets sold by Southeast Asian reseller CryptoBilis are linked to a major crypto theft. The company stated that all verified cases of drained wallets involve devices from this specific distributor, while its direct channels remain uncompromised.

What happened

Ledger issued an update on October 11, stating that all confirmed cases related to the October 9 draining incident involve devices sold through CryptoBilis. According to Help Net Security, on-chain researchers estimated suspected losses at more than $93 million. The Paris-based maker clarified that its own systems and direct sales channels were not compromised in this event.

Former Mt. Gox CEO Mark Karpelès provided the most detailed account of the tampering, claiming he purchased a compromised Ledger in Malaysia. Photos and videos he posted on X showed a small circuit board hidden under the device’s screen, replacing the standard display padding. Karpelès stated that this board contained a microcontroller, an antenna, an LTE chip, and an e-SIM card.

He explained that the implant monitors the screen to capture the seed phrase as it is displayed to the user. The device then transmits this sensitive data to an attacker via the LTE connection. With the recovery phrase, an attacker can rebuild the wallet on any device and empty it remotely without touching the original hardware. This method allows for quiet collection of phrases followed by a coordinated strike, matching the wave of drains reported on October 9.

Why it matters

The implant is difficult to detect without physical disassembly. Karpelès noted that his device arrived in intact shrink wrap and passed Ledger’s Genuine Check because the internal security chip was authentic. He stated that the only reliable way to find the extra circuit board is to open the device casing. This undermines standard verification methods for end users.

Ledger has not commented on unverified claims that wallets sold in Europe via official reseller Mediamarkt might have been similarly tampered with. The company confirmed it is working with relevant authorities and reaching out to impacted users. Ledger urged customers who bought from CryptoBilis to refrain from initializing the device if they have not already done so. Users are advised to contact Ledger Support through official channels and file complaints with local law enforcement.

What to watch

• Monitor Ledger’s official communications for updates on the scope of compromised devices.
• Watch for further details on how the implant bypassed standard security checks.
• Observe if other resellers or regions are implicated in the tampering scheme.
• Track the progress of law enforcement investigations into CryptoBilis.

What to do and how to stay safe: Ledger

• Verify the purchase history of any hardware wallets to ensure they came from authorized distributors.
• Inspect the physical integrity of the device casing for signs of tampering or unusual thickness.
• Avoid initializing new devices until their provenance is confirmed and no security alerts exist.
• Monitor blockchain addresses associated with the device for any unauthorized transactions.

Step-by-step guide: Software Updates Best Practices: Secure Patching Without Downtime

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did Ledger confirm that its own servers were hacked?

No, Ledger stated that its own systems and direct sales channels were not compromised.

How much money was stolen in this incident?

On-chain researchers put suspected losses at more than $93 million.

Can users detect the implant without opening the device?

No, Karpelès said the only reliable way to find the board is to open the device.