Ledger Confirms Hardware Implant in Device Linked to Crypto Theft

Ledger confirmed that one device linked to reports of cryptocurrency theft contained an unauthorized hardware implant. The reports involved devices sold through CryptoBilis, a Malaysia-based retailer that operates across Southeast Asia.

On October 9, Ledger said it had opened an investigation into user reports of lost funds and asked CryptoBilis to stop selling and shipping Ledger devices. The following day, Ledger confirmed tampering in at least one device. The company said it was contacting affected users and working with authorities to identify the perpetrator. It described the number of affected users as “limited” and said all reports of unexpected fund losses were linked to devices sold through CryptoBilis. Ledger has not disclosed which device models were affected or how and when they were modified.

Researchers and security figures reported finding implants in Ledger X devices. Mark Karpelès said one implant was concealed behind the screen. Tibane Labs reported two variants, describing circuitry that could capture screen output and button presses and send data over LTE using an eSIM. The researchers said one variant replaced the original battery with a smaller one, while the other fit under the OLED display and used the original battery.

Ledger advises customers who have not set up a device bought from the reseller not to begin setup. For devices already set up, it suggests considering a move to a new Ledger signer with a new seed. Ledger also warns that its Genuine Check cannot detect an added implant if the original Secure Element remains intact.