Hardware wallet manufacturer Ledger confirmed on Oct. 10 that an unauthorized physical hardware implant was discovered in an affected customer's device, while independent security researchers estimate that stolen cryptocurrency funds linked to modified units have reached $93.2 million.
Following the discovery, CryptoBilis, an authorized reseller operating in Southeast Asia, suspended all sales of hardware wallet inventory pending the outcome of the investigation. While Ledger has not stated how many units were modified, the company confirmed there is no evidence that its internal security infrastructure, systems, or services were compromised.
Key Takeaways
- Ledger confirmed a physical hardware implant in a Nano X unit, leading reseller CryptoBilis to suspend inventory sales.
- Theft estimates range from $91 million across 477 addresses (Galaxy Digital) to $93.2 million across 315 wallets (Bitquery).
- Ledger's Genuine Check verifies the secure element chip but cannot detect physical implants intercepting display screen data.
- Tether has frozen $10 million in stolen USDT, while $5.35 million in USDC moved through Tornado Cash and Zcash.
How the Hardware Implant Bypasses Security Checks
An investigation by Tibane Labs, led by former Mt. Gox CEO Mark Karpelès, documented three generations of Ledger Nano X implants engineered to intercept 24-word recovery phrases. The modified devices utilize additional microcontrollers to read screen data signals transmitted between the wallet's secure element chip and its display screen. The stolen recovery phrase is then transmitted remotely via hidden LTE modems and SIM components without altering the physical secure chip.
Because Ledger's Genuine Check security tool only verifies the authenticity of the secure element chip itself, it fails to flag physical spy chips placed along the display pathway. Tibane Labs examined two compromised devices purchased on Japanese marketplaces, building upon previous teardown work by hardware hacker Joe Grand. The advanced implant version contained a custom circuit board hidden under the screen while preserving the original device battery.
On-Chain Theft Analysis and Asset Freezes
According to Galaxy Digital research executive Alex Thorn on Oct. 9, total suspected thefts reached $91 million across 477 addresses. This included $64.5 million on Tron (comprising 64.3 million USDT), $17.7 million in Bitcoin (approximately 213 BTC), and $8.8 million across Ethereum and related networks.
A separate Oct. 11 report by blockchain analytics firm Bitquery identified $93.2 million in losses across 315 wallets on six blockchains. Bitquery highlighted a coordinated withdrawal on Oct. 9 where 25 Tron wallets signed identical token approvals within three seconds, draining $29 million USDT. Amid ongoing concerns regarding hardware wallet attacks triggering $205M in losses, Bitquery noted that Tether froze $10 million in stolen USDT, while Circle could freeze $5.35 million in USDC. CryptoQuant analyst Darkfost suggested auditing regional reseller chains for potential exposure.
Why It Matters
This exploit highlights a critical vulnerability in cryptocurrency hardware supply chains, proving that cryptographic verification tools are insufficient when physical hardware is intercepted. Because the implant intercepts display signals directly, seed phrases generated on compromised units are exposed from the moment of setup. Moving forward, crypto investors must prioritize purchasing directly from manufacturers and generate entirely new seed phrases whenever transferring assets to replacement hardware.
