Nearly half-price hardware wallets from one reseller hid an implant, and the maker’s own check misses it while the original Secure Element is intact

Ledger, the French hardware wallet maker, confirmed on October 10, 2026 that a device sold through the Malaysia-based reseller CryptoBilis contained an unauthorized hardware implant. The units were priced at nearly half the cost of genuine hardware, which made them an easy buy for anyone hunting a bargain on a cold wallet. Ledger also acknowledged that its own authenticity tool cannot catch this kind of tampering.

The confirmation covers one examined device, not a count of modified units. Ledger has not said how many were altered, and nobody has published an official loss total. The story is still moving, so the claims below are attributed to the people and organizations that made them.

The implant Mark Karpelès photographed and Tibane Labs took apart

Ledger opened an investigation on October 9 after users reported emptied wallets, then asked CryptoBilis to stop selling and shipping, BleepingComputer reported on October 12. The following day Ledger said in an October 10 post on X that one of the impacted users’ devices contained an unauthorized hardware implant, and that it was contacting affected users and working with authorities to identify whoever was responsible.

The physical evidence came from outside the company. Mark Karpelès, the former Mt. Gox chief executive who now runs Karpeles Lab and Shells.com, published a photo of an implant found in a Ledger Nano X. By his account the device captures the display output and button presses to recover the seed phrase, then transmits it over LTE using an eSIM. Karpelès did not name the seller in his own description, saying only that the unit came from a well known platform via a Chinese seller, shipped from Malaysia.

Tibane Labs, a crypto research studio, confirmed his finding and analyzed two variants, according to the same report. In its published teardown, the lab describes three generations of Nano X implants. Earlier versions used visible wiring and a smaller replacement battery to make room, with an antenna taped across the battery and LTE module. The September specimen hid a board under the screen and kept the original battery, so it could look normal. Both variants used an STM32 microcontroller, an eSIM and a shielded LTE module, and Tibane said the board looked professionally manufactured rather than hand-built.

One caveat matters here. Tibane’s two specimens were bought through Japanese marketplaces, Amazon Japan and Yahoo! Auctions Japan, from sellers shipping out of Malaysia, and not directly from CryptoBilis. CryptoSlate noted that the report does not establish which design was used in the reseller-linked thefts, and that Ledger has not publicly described its own finding in technical detail.

Why Genuine Check passes a device with a spy board inside

Ledger’s own documentation explains the gap. Its device genuineness threat model says Genuine Check verifies that the Secure Element, the tamper-resistant chip that holds the keys, is authentic. It does not detect unauthorized physical modifications such as spying implants as long as that original chip remains intact. BleepingComputer put the same limit in plain terms: the tool cannot detect added implants when the device’s original Secure Element remains intact.

In practice the check asks the real chip to prove it is real, and the real chip can do that perfectly well while a second board sits beside it, watching the screen. Karpelès has said his tampered device passed the check. This is why the claim is conditional: the check fails to flag the implant only in the case where nobody has swapped or damaged the original chip, and the reported implants appear designed to leave it alone.

What Ledger and the reseller have said about CryptoBilis

Ledger’s position is that all confirmed cases tied to the October 9 disclosure involved devices sold through CryptoBilis, which it describes as an authorized reseller in Southeast Asia. A later update, per BleepingComputer, characterized the affected volume as limited. Ledger says it found no sign that its own security infrastructure, systems or direct sales channel was compromised, and that it is developing stronger anti-tampering protections.

No statement from CryptoBilis itself appeared in the reporting reviewed for this article, so intent is not established. CryptoSlate reports that the reseller suspended sales of all hardware wallet inventory pending the investigation, but the record does not say who installed the implants or at what point in the supply chain it happened. Ledger’s instruction to buyers is direct: those who have not set up a CryptoBilis device should not start setup, and those who have should move assets to a new signer with a freshly generated recovery phrase.

How big the losses are, and what the supply-chain lesson is

Loss figures come from outside analysts and differ. Alex Thorn of Galaxy Digital research estimated about $91 million across 477 addresses on October 9, while the blockchain data firm Bitquery, updating on October 11, put the total near $93.2 million from 315 wallets across six blockchains. The two use different address sets and methods, and neither counts tampered devices, so they should be read as estimates of suspected theft rather than a confirmed tally.

The lesson is narrower than it first appears. Ledger advises buyers to avoid unauthorized resellers and tells authorized ones to source only through authorized channels and never restock returned products. A seed phrase displayed on a device that left the maker’s control cannot be trusted just because an authenticity check passed. Speculation that other regional resellers are exposed has circulated, but one analyst who raised it acknowledged it is not backed by confirmed evidence.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

More from Morning Overview