Ledger Confirms Hardware Implants in CryptoBilis Wallets Linked to Cryptocurrency Theft
Ledger has confirmed that at least one device distributed through Southeast Asian reseller CryptoBilis was compromised by a hardware implant capable of stealing cryptocurrency from users’ wallets.
The company began investigating reports of cryptocurrency losses involving Ledger devices purchased through CryptoBilis, a Malaysia-based hardware wallet retailer that operates across Southeast Asia.
Researchers have been documenting the implants since September 16, including examples found in Ledger Nano X devices. The tampered wallets were reportedly sold for nearly half the price of genuine hardware.
Ledger investigates CryptoBilis wallet theft reports
A Ledger wallet is a physical device designed to protect the private keys used to control cryptocurrency assets and authorize transactions.
On October 9, Ledger said it had launched an investigation into reports of cryptocurrency losses and asked CryptoBilis to stop selling and shipping Ledger devices.
The following day, Ledger confirmed that at least one affected device had been tampered with. The company has not yet determined when or how the modification occurred.
“The Ledger can confirm that one of the affected users’ devices contains a rogue hardware implant. The Ledger is contacting the affected users as part of our ongoing investigation.”
Ledger also said it was working with authorities to identify the perpetrators and bring them to justice.
In a warning to customers, Ledger advised users who purchased devices from the reseller not to begin setup if they had not already done so. Users who had started setting up a device were advised to consider moving their assets to a new Ledger signer using a new seed.
Ledger later said that all user reports of unexpected fund outflows were related to devices sold through CryptoBilis, while describing the number of affected users and transactions as “limited.”
How the Ledger Nano X implants allegedly worked
Ledger has not disclosed which device models were compromised. However, reports from researchers have focused on Ledger Nano X hardware wallets containing covert electronic implants.
Mark Karpelès, the former CEO of Mt. Gox and current leader of Karpeles Lab Inc. and chief technology officer of Shells.com, shared photographs of an implant found in a Ledger Nano X. He described it as “quite an evolution” from earlier versions that used hand-soldered wires.
Karpelès said the implant was hidden behind the device’s screen, although its antenna cable could have indicated that the wallet had been modified.
According to Karpelès, the malicious hardware captured the device’s display output and button presses to determine the user’s seed phrase. The phrase was then transmitted to attackers over an LTE connection using an eSIM.
“Ledger Nano X is used to store cryptocurrencies. Spy implants are used to steal cryptocurrencies stored on Ledger Nano X,” Karpelès explained.
He did not identify CryptoBilis as the vendor of the compromised device. However, he said it had been purchased through a well-known platform from a Chinese seller, with the product shipped from Malaysia, rather than through Ledger’s recommended sales channels.
Researchers identify two implant variants
Cryptocurrency research and development studio Tibane Labs confirmed Karpelès’ findings and reported that it had identified two versions of the implant.
Researchers obtained one device through Amazon Japan from a seller based in China with the product shipped from Malaysia. The second was purchased through Yahoo! Auctions in Japan.
In a report published over the weekend, Tibane Labs said the attackers created space for the malicious circuitry by replacing the original battery with a smaller one.
“Underneath the battery and antenna is an ST STM32G431KBU6 (Arm Cortex‑M4, 128 KB Flash, UFQFPN‑32),” researchers found inside one of the devices.
The implant used a small eSIM in an eight-pad package measuring approximately 2 by 2 millimeters, positioned next to the microcontroller. A shielded LTE module was used to transmit the captured data.
Read Tibane Labs’ analysis of the Ledger Nano X implant.
In the second hardware wallet, the markings on both the microcontroller and eSIM had been scratched off to conceal their part numbers.
This variant appears similar to the implant described by Karpelès but is more advanced. It runs on the device’s original battery and fits in the space normally occupied by a foam pad beneath the OLED display.
In both devices, the antenna wire provided evidence of the modification. In the second implant, the antenna ran along the upper edge of the device. In the first, it was taped to the top of the battery and across the shielded LTE module.
Researchers warned that one sample used “an engineered and panelized flex PCB of the kind ordered from a board house, rather than a hand-built one-off.”
Ledger warns against unauthorized resellers
Ledger advises customers to avoid unauthorized resellers because of the increased risk of receiving counterfeit or modified hardware wallets.
The company also reminded authorized resellers and distributors to obtain products only through approved channels and not to restock returned devices.
Ledger provides an authenticity-check mechanism for verifying devices. However, the company warns that this check may not detect an added hardware implant if the device’s original secure element remains intact.
Read Ledger’s authenticity-check guidance.
There is currently no indication that other Ledger resellers are shipping compromised wallets. However, the incident has weakened confidence in the reseller network, with some members of the cryptocurrency community calling for it to be dismantled.
Join Mikko Hypponen and security leaders from the NFL, Chanel, and Atlassian for a two-hour digital summit about AI-powered attacks, defensive strategies, and how to verify, decide, fix, and revalidate at machine speed.
Source: www.bleepingcomputer.com