Ledger Implant Exposes Limit Of Genuine Check

Ledger confirmed on Oct. 10 that an unauthorized hardware implant was found in a device belonging to one affected customer. The confirmation followed reports of cryptocurrency losses from customers who bought Ledger devices through CryptoBilis, an authorized reseller in Southeast Asia. CryptoBilis suspended sales of its hardware wallet inventory while the investigation continues.

Ledger has not disclosed how many devices were modified or established that the implant caused every reported loss. The company found no evidence that its security infrastructure, systems or services had been compromised. It is contacting affected users, coordinating with authorities and developing additional anti-tampering protections.

Investigators have estimated the suspected losses at more than $90 million. Galaxy Digital research executive Alex Thorn calculated about $91 million taken from 477 addresses across Bitcoin, Ethereum-related networks and Tron. Blockchain analytics firm Bitquery estimated about $93.2 million in suspected thefts from 315 wallets across six blockchains. The estimates use different address groups and methods and do not indicate how many devices were modified.

Bitquery identified a coordinated operation on Oct. 9. Its analysis found that 25 Tron wallets approved the same token transaction within three seconds, allowing about $29 million in USDT to be withdrawn. The firm also found small test transactions carried out over about two weeks before the larger withdrawals. Tether had frozen about $10 million in stolen USDT by Oct. 11. Circle could freeze $5.35 million in USDC that had moved through Tornado Cash and Zcash, according to the analysis.

Tibane Labs examined modified Ledger Nano X devices bought through Japanese marketplaces and documented three generations of implants designed to capture wallet recovery phrases. The devices were not publicly linked to CryptoBilis, and the investigation has not established whether the reseller-linked devices used the same design.

A Ledger device creates a 24-word recovery phrase during setup. The words originate inside the secure element but pass through the display circuitry so the owner can read them. Tibane Labs found additional microcontrollers in modified devices that could read those signals, reconstruct the phrase and transmit it through cellular modems containing SIM components.

Earlier implant designs used visible wiring and smaller replacement batteries to make room for the added electronics. A more advanced device examined in September contained a custom circuit board beneath the screen, an LTE modem and an antenna. It retained the original battery and could appear normal after the casing was opened.

Ledger’s Genuine Check confirms that a device contains an authentic secure element. It does not inspect every physical component or detect unauthorized electronics when the secure element remains intact.

Ledger has advised customers who bought devices from CryptoBilis not to initialize unused wallets. Customers who already set up such devices should transfer their assets to a trusted device using a newly generated recovery phrase. Reusing a phrase displayed on a compromised device could leave the funds accessible to an attacker.