Hardware wallet manufacturer Ledger officially confirmed the discovery of unauthorized hardware implants inside customer units on October 10, 2026. Labeled as an unauthorized hardware implant, the findings directed the investigation toward CryptoBilis, a distributor serving the Indonesian, Malaysian, and Philippine markets. The manufacturer’s confirmation now substantiates independent physical findings previously revealed by blockchain researchers.
Loss reports from CryptoBilis buyers began surfacing on October 9. Blockchain researchers estimated losses exceeding $86 million, with one report putting the figure as high as $92 million. What sets this case apart is not merely the financial scale, but the pristine physical condition of the packaging when delivered to victims.
What Was Found Behind the Nano X Screen
Former Mt. Gox exchange CEO Mark Karpelès disassembled a Ledger Nano X unit from Malaysia and discovered an extra electronic component behind the display panel. The component was neatly wrapped inside the screen’s protective material, making the modification impossible to detect without dissecting the device.
Technical analysis by Tibane Labs revealed the rogue device’s contents: a microcontroller, a cellular communication module, and a direct connection to the display data lines. This circuitry reportedly copies the 24-word recovery phrase during wallet setup, then transmits the secret key over cellular networks without the owner’s knowledge.
The device’s outer packaging appeared intact and factory-sealed upon arrival. The supply chain tampering was executed so seamlessly that standard visual inspection failed to detect the internal hardware modifications.
Distributor Halts Sales and Former Executives Offer Alibi
Ledger immediately instructed CryptoBilis to halt all hardware wallet sales as a precautionary measure. Ledger management emphasized that the company’s internal security infrastructure remained unbreached, adding that it had coordinated with law enforcement to investigate the incident.
Clarifications also came from former CryptoBilis executives. Arravind Prabu and Vimalatheethan stated they had relinquished all operational control of the company in March 2026 following an ownership transition.
The financial fallout materialized vividly in Teluk Intan, Malaysia. A 38-year-old man lost RM12.47 million, equivalent to $3.05 million, through unauthorized transactions on October 9. Local police are now investigating the breach under Section 420 of the Malaysian Penal Code.
Old Recovery Keys Must Be Abandoned
For CryptoBilis wallet buyers, transferring funds to a new physical unit is not enough if they continue using their old recovery phrase. Users are urged to move their balances to a fresh wallet set up with an entirely new 24-word recovery phrase from scratch. Entering the old phrase into a new unit would merely shift funds to an address whose private key has already been compromised.
Reported via crypto.news.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
