Ledger has confirmed that a hardware wallet belonging to one of its customers contained an unauthorized implant, as independent investigators estimate $93.2 million in suspected cryptocurrency thefts.
In an Oct. 10 statement, the hardware wallet manufacturer said the discovery involved a device belonging to one of the affected users. CryptoBilis, an authorized reseller operating in Southeast Asia, has suspended sales of all hardware wallet inventory pending the investigation's conclusion.
The investigation began after customers reported losing cryptocurrency after buying Ledger devices from the reseller. Ledger has not said how many devices were modified or established that the implant caused all the reported losses. The company said it had found no indication that its security infrastructure, systems or services had been compromised.
Research by Tibane Labs, led by former Mt. Gox chief executive Mark Karpelès, has documented three generations of Ledger Nano X implants designed to intercept recovery phrases. The report combines Joe Grand's teardown of an earlier implant with two specimens Tibane examined in September.
According to the research, the implants work by monitoring electronic signals sent between a wallet's secure element and its display. During setup, a Ledger device generates a 24-word recovery phrase that lets its owner restore access to cryptocurrency holdings. Although the words originate inside a secure chip, they must pass through the device's display circuitry to appear on the screen.
The modified devices contained additional microcontrollers that could read the screen's data, reconstruct the recovery words, and transmit them via cellular modems with SIM components. Attackers could therefore obtain the credentials needed to reconstruct a victim's wallet remotely without stealing the physical device or compromising Ledger's secure chip.
Earlier versions used visible wiring and smaller replacement batteries. A more advanced version examined in September contained a custom circuit board hidden under the screen, with an LTE modem, an antenna and components with removed identifying markings. That version preserved the original battery and could appear normal even after its casing was opened.
Ledger's security documentation says Genuine Check verifies the secure element's authenticity but cannot detect unauthorized physical modifications, such as spying implants, if that element remains intact.
Tibane's two specimens were bought through Japanese marketplaces, not from CryptoBilis. The report does not establish that this design was used in the reseller-linked thefts, and Ledger has not publicly described the implant it found. Tibane Labs warned that a recovery phrase displayed on a compromised device should be treated as exposed.