Ledger has confirmed a hidden hardware implant in a Nano X wallet belonging to one affected user, tying a wave of coordinated cryptocurrency drains to devices bought from the reseller CryptoBilis. Bitquery estimates the losses at $93.2 million across 315 wallets, though other outlets report different totals.
Coordinated Wallet Drains Began on October 9
The drains began at about 04:59 UTC on October 9. Bitquery’s breakdown of the $93.2 million puts $70.5 million on TRON, $16.8 million on Bitcoin and $3.7 million on Ethereum, with the remainder spread across BNB, Polygon and Solana.
Conflicting Loss Figures: $80 Million to $93.2 Million
Reported losses vary. The initial estimate was $86 million or more, other outlets cite $92 million to $93 million, and one outlet claims $80 million or more. The Bitquery figure of $93.2 million across 315 wallets is the most detailed available. No single total is confirmed.
Karpeles Teardown Finds an LTE Module on the Screen Bus
Mark Karpeles, the former Mt. Gox CEO, examined a Nano X from Malaysia that was still shrink-wrapped. He reported a hidden module with an LTE component, an antenna, an eSIM and a microcontroller attached to the screen’s SPI bus. That placement would let it watch the seed phrase as it is displayed. The genuine Secure Element in the device was intact.
The finding is significant because it describes tampering outside the Secure Element, the part of the device designed to protect keys. The implant instead observes what the screen shows.
Ledger’s October 11 Statement
Ledger confirmed a hidden implant in one affected user’s device. On October 11 it said the number of impacted devices is “limited” and tied to purchases from CryptoBilis. Ledger said its own sales channels are unaffected.
CryptoBilis Halts Sales After Ownership Change
The reseller sold to buyers in Malaysia, Indonesia and the Philippines, and some tampered devices were reported in Europe. CryptoBilis halted all hardware-wallet sales and closed its channels.
Its former co-founders say control moved to new management in March under confidentiality terms. That ownership change is the only corporate event the reporting connects to the reseller, and it does not establish when or how the devices were altered.
Unverified Theories About the Attackers
There is speculation about North Korean involvement and a hostile acquisition of the reseller. Neither is verified, and the reporting offers no evidence for either.
Impact on Hardware-Wallet Resale Channels
The theft totals roughly $93 million from hundreds of wallets and damages trust in resale channels for hardware wallets. Ledger’s investigation continues, and CryptoBilis sales are suspended.
Several points remain open. The reporting does not state how many devices were tampered with beyond Ledger’s description of “limited.” It does not explain how the implant relays data, beyond Karpeles’s description of the LTE module and eSIM components, or how the drains were timed to begin together at 04:59 UTC on October 9.
The case is a hardware supply-chain compromise in which devices were allegedly altered before reaching buyers. That differs from attacks on software wallets or exchanges, because the owner’s own device is the point of leakage. The pattern of buyers from one reseller across Malaysia, Indonesia and the Philippines, with some reports from Europe, is the link Ledger draws between the affected devices.
What Is Known About the Timeline
The timeline begins in March, when former co-founders say control of CryptoBilis moved to new management under confidentiality terms. The drains began about 04:59 UTC on October 9, the same day Karpeles published his teardown of the Malaysian Nano X and Ledger issued a warning. Ledger’s confirmation of a hidden implant in one user’s device and its statement that the number of impacted devices is “limited” followed on October 11.
Ledger’s position is that its own channels are unaffected, which places the affected devices in the reseller channel. The company has not described how many CryptoBilis customers received tampered units. Coverage also does not say whether the funds taken from the 315 wallets have been traced or recovered.
The gap between the roughly $80 million at the low end of reported figures and the $93.2 million Bitquery estimate shows how fluid the numbers are while the investigation continues.
