Ledger confirmed, on Saturday October 10, the presence of an unauthorized hardware implant in the device of a user involved in its investigation into cryptocurrency thefts. The reports relate to products purchased from CryptoBilis, a reseller operating in Southeast Asia. The discovery establishes physical alteration in at least one device; its role in overall reported losses remains to be determined.
The case challenges a critical component of the security of hardware wallets: their integrity between manufacturing and first use. A secure chip may be genuine, and the device surrounding it may have been modified. For Ledger, the investigation must now specify the extent of the exposure and trace the route of the products concerned.
Significant losses, a still provisional assessment
On October 9, Ledger announced the opening of an investigation and asked CryptoBilis to suspend sales and shipments of its devices. The manufacturer recommended that customers who had purchased from this reseller in the previous 90 days not begin their configuration.
The pseudonymous analyst Specter then mentions more than $86 million in potential losses on several hundred portfolios. CoinDesk clarified that this amount had not been independently confirmed. In its investigation updated on October 11, Bitquery estimates the funds misappropriated at $93.2 million across 315 wallets, spread across six blockchains.
This figure is based on an analysis of the transactions and addresses that Bitquery links to the incident, an assessment which is not confirmed by Ledger, especially since the number of wallets identified does not make it possible to directly deduce the number of people affected.
A confirmed implant, its functioning still to be established
In its October 10 update, Ledger confirmed the implant, without releasing a full demonstration of how it worked or establishing that it explained all the reported thefts. The company also indicates that it has no indication of compromise of its security infrastructure, systems or services.
The first public descriptions suggest a component added near the screen, likely to intercept information displayed during configuration. The recovery phrase appears on the screen when the user initializes their wallet. Its interception could expose the secret that allows access to assets to be restored.
A hardware wallet stores private keys and allows transactions to be signed; cryptocurrencies remain registered on blockchains. The recovery phrase allows these keys to be reconstructed on another device. Its compromise can therefore give a third party the ability to move funds without possessing the original device. When an additional passphrase protects the wallet, this secret is also necessary to find the corresponding keys.
In the scenario of an interception of the display, a customer could generate his own sentence and keep it on paper, according to the usual instructions, while the hardware would capture a copy.
The authenticity check has a precise limit
Ledger describes this distinction in its secure device purchasing documentation. The “Genuine Check” cryptographically verifies the authenticity of the secure component. However, it cannot detect certain physical modifications, including spy implants, when the original chip remains intact.
This control therefore provides a guarantee on an essential component, without certifying the entire physical journey of the device. Authenticity and integrity answer two complementary questions: does the product contain a legitimate chip, and does it contain only the elements intended by its design?
The incident thus raises a question of architecture as much as distribution. The resistance of the secure component must be assessed with the possibilities of modifying the elements which surround it, in particular those by which sensitive information is presented to the user.
Modified devices had already circulated
The risk has documented precedents, so in June 2021, Kraken Security Labs described a modified Ledger Nano A small USB memory had been added inside. It contained a fraudulent application intended to obtain the recovery phrase by asking its owner to enter it into their computer. Kraken then reproduced this scenario.
In May 2022, Trezor reported tampered devices being sold on unauthorized Russian marketplaces. In an expert opinion published in May 2023, Kaspersky describes a Model T whose microcontroller had been replaced and the internal software modified to select a recovery phrase from twenty predefined phrases. The device had an ordinary interface, but the attackers knew the secrets it used.
These incidents show that hardware wallets have already been modified before use. Their mechanisms, however, differ from the interception of the display envisaged in the CryptoBilis affair, the precise functioning of which remains to be established.
The distribution enters the security perimeter
This incident raises the question of controls within the commercial network. CryptoBilis appearing in the official lists of Ledger resellers, since sales of Ledger products by this distributor have been suspended, without attributing the origin of the alteration to the reseller or presuming that he had knowledge of it.
The investigation must establish where the devices may have been modified, whether during transport, storage or another stage of their circulation. It must also specify the batches concerned and any intermediaries. Ledger states in its documentation that its distribution agreements prohibit partners from relisting returned devices.
For manufacturers of hardware wallets, this case is a reminder that the promise of security involves a complete chain. Electronic design, logistics controls and business practices together contribute to the integrity of the received product, especially since the customer generally has limited means to examine this continuity themselves.
Protecting customers while the investigation continues
For affected buyers who have already configured their device, Ledger recommends considering transferring assets to a new device initialized with a new recovery phrase. Restoring a potentially exposed phrase on a new device would retain the risk associated with its compromise. The manufacturer also reminds that the sentence must never be communicated to an interlocutor presenting themselves as their support.
