Ledger confirms wallet implant as suspected theft estimates reach $93.2 million
In brief
- Ledger confirmed an unauthorized hardware implant in one affected customer's wallet in an Oct. 10 statement.
- CryptoBilis, an authorized Southeast Asian reseller, suspended all hardware wallet sales pending the investigation.
- Bitquery counts about $93.2 million in suspected thefts; Galaxy's Alex Thorn reported about $91 million.
- Genuine Check can't detect physical implants if the secure element is intact, according to Ledger's documentation.
What Ledger has (and hasn't) said
According to Ledger's Oct. 10 statement as reported by CryptoSlate, the discovery involved a device belonging to one of the affected users. CryptoBilis has suspended sales of all hardware wallet inventory until the investigation concludes, Ledger said.
That's where the confirmed facts stop.
Ledger hasn't said how many devices were modified, and it hasn't established that the implant caused all the reported losses. It also said it found no indication that its own security infrastructure, systems or services had been compromised.
How the implants work
Former Mt. Gox CEO Mark Karpelès has been examining suspicious Ledger Nano X devices through Tibane Labs, which documented three generations of implants built to intercept recovery phrases. Its report pairs Joe Grand's teardown of an earlier implant with two specimens Tibane examined in September. A Ledger generates a 24-word recovery phrase during setup, and while the words originate in a secure chip, they pass through the display circuitry to reach the screen. Tibane found extra microcontrollers that read that screen data, rebuilt the words and sent them out over cellular modems with SIM components.
No device theft required.
Earlier versions used visible wiring and smaller replacement batteries. The September version hid a custom circuit board under the screen (with an LTE modem, an antenna and components stripped of identifying markings), kept the original battery and could look normal even with the casing opened. Ledger's own security documentation says Genuine Check verifies the secure element's authenticity but can't detect physical modifications like spying implants if that element stays intact.
One caveat matters here. Tibane's specimens were bought through Japanese marketplaces, not from CryptoBilis, and its report doesn't establish which design was used in the reseller-linked thefts. Ledger hasn't publicly described the implant it found.
How big are the losses?
Galaxy Digital research executive Alex Thorn reported on Oct. 9 about $91 million across 477 addresses on Bitcoin, Ethereum-related networks and Tron. He put $64.5 million on Tron (about 64.3 million USDT), $17.7 million on Bitcoin (roughly 213 BTC) and $8.8 million on Ethereum and related networks.
Bitquery counted about $93.2 million from 315 wallets across six blockchains in an investigation updated Oct. 11, and flagged patterns suggesting attackers controlled multiple wallets before a coordinated withdrawal on Oct. 9. The two estimates use different address sets and methods; neither counts tampered devices.
Tibane's guidance is blunt. A phrase shown on a compromised device should be treated as exposed, and funds need to move to a wallet with a new phrase generated on a trusted device (swapping hardware while reusing the old phrase doesn't help).
Frequently asked questions
How do the Ledger wallet implants steal recovery phrases?
According to Tibane Labs, the implants monitor signals sent between the wallet's secure element and its display. Extra microcontrollers read the screen data, rebuild the 24 recovery words and send them out over cellular modems with SIM components, so attackers can rebuild the wallet remotely.
Can Ledger's Genuine Check detect implants like those Tibane documented?
Ledger's security documentation says Genuine Check verifies the secure element's authenticity. It can't detect physical modifications like spying implants if that element stays intact. The implants Tibane documented work by reading display signals, not by compromising the secure chip.
What should owners of a possibly compromised Ledger do?
Tibane Labs said a recovery phrase displayed on a compromised device should be treated as exposed. Funds must move to a wallet with a new phrase generated on a trusted device. Replacing the device while reusing the old phrase would leave the wallet accessible to an attacker.
How much crypto has been stolen in the Ledger implant cases?
The estimates aren't confirmed. Bitquery counted about $93.2 million from 315 wallets across six blockchains, and Galaxy Digital's Alex Thorn reported about $91 million across 477 addresses. They used different address sets and methods, and neither counts tampered devices.
