Security

Spy Chip Implant Found in Ledger Devices Sold by CryptoBilis

Ledger confirmed that some devices sold through CryptoBilis were compromised with a hardware implant that drained users' cryptocurrency wallets, with losses exceeding $86 million.

AI-generated editorial illustration of the article topic; not a photograph, product screenshot or measured result.

Confirmation of Spy Chip Implant in Ledger Devices

Ledger has confirmed that some of its devices distributed through Southeast Asian reseller CryptoBilis were compromised with a hardware implant that drained users' cryptocurrency wallets. The company stated that one of the impacted users’ devices contained an unauthorized hardware implant, and that all user reports of unexpected fund drains were linked to devices sold through CryptoBilis, with the affected volume described as “limited.”While Ledger did not disclose the type of devices compromised in this supply-chain attack, reports online suggest a spy implant in Ledger X devices that blends with the legitimate hardware. The company has temporarily paused sales of its products via CryptoBilis following reports of stolen funds linked to devices sold by the reseller. Ledger has advised users to move assets to a new Ledger signer (with new seed) and warned against purchasing from unauthorized resellers, emphasizing the risk of buying suspicious, counterfeit, or modified devices.

Details of the Spy Chip Implant and Its Functionality

Details of the Spy Chip Implant and Its Functionality reveal a sophisticated hardware modification targeting Ledger X devices. According to Mark Karpelès, former CEO of Mt. Gox and CTO at Shells.com, the implant represents an evolution from earlier versions that used manually soldered wires. The spy implants are used to steal whatever crypto you store in those Ledger Nano X, Karpelès explained. Tibane Labs reported that the threat actor replaced the original battery with a smaller one to power both the implant and the Ledger X. For connectivity, the actor used a tiny eSIM, an 8‑pad package just 2×2 mm, next to the MCU, and a shielded LTE module that sends the words out. In one device, Tibane researchers found that markings on both the MCU and the eSIM had been scraped off to hide the part numbers. In the first implant, the antenna is taped across the top of the battery and the shielded LTE module.

Impact on Users and Ledger's Response

Ledger has confirmed that a supply-chain attack involving compromised devices sold through CryptoBilis led to cryptocurrency thefts, with losses exceeding $86 million, as reported by pseudonymous investigator Specter. The company has urged users who purchased devices from this reseller in the last 90 days to avoid initializing their wallets if they have not already done so. Additionally, Ledger warned that if a recovery phrase was pre-printed or shared with others, the wallet should be considered unsafe. Users are advised never to share recovery phrases or PINs. In response, Ledger has launched an investigation and asked CryptoBilis to halt sales and shipments of its devices. The affected volume of devices was described as 'limited,' though details about the specific models compromised remain unclear. The company also emphasized the importance of resellers sourcing products only through authorized channels and avoiding restocking returned items.

Technical Analysis of the Implant and Its Components

Tibane Labs has confirmed the presence of a hardware implant in a Ledger X wallet, designed to facilitate unauthorized access to cryptocurrency funds. The implant was made possible by replacing the original battery with a smaller one, which powers both the malicious circuitry and the device itself. For connectivity, the threat actor used a 2×2 mm eSIM and a shielded LTE module, with the antenna taped across the top of the battery. Researchers noted that the MCU and eSIM had their markings scraped off to obscure part numbers, suggesting an attempt to avoid detection. The implant used a panelised flex PCB, indicating it was manufactured in bulk rather than being a custom-built component. Ledger has advised users to avoid purchasing from unauthorized resellers, as these channels increase the risk of receiving counterfeit or modified devices. The company also urged authorized resellers to source products only through official channels and to avoid restocking returned items.

Recommendations and Security Measures from Ledger

Ledger has issued specific recommendations and security measures in response to the confirmed spy chip implant issue affecting its hardware wallets. The company advises users who purchased devices from a specific reseller within the last 90 days to avoid initiating setup if they have not already done so. Additionally, Ledger warns users that if their device came with a recovery phrase already printed or written on a card or sheet, or if anyone other than the user has seen their recovery phrase, the wallet should be treated as unsafe. Users are strongly cautioned never to share their recovery phrase or PIN with anyone. To ensure authenticity, Ledger provides a ‘Genuine Check’ mechanism, though it explicitly states that this cannot detect added implants if the device’s original Secure Element remains intact. The company also urges resellers and distributors to source products only through authorized channels and to avoid restocking returned products.