Ledger confirms a hidden cellular implant in a wallet sold by reseller CryptoBilis as theft estimates reach $93 million

Ledger, the French maker of hardware wallets, confirmed an unauthorized hardware implant inside a customer's device. It found the implant during an October 10 investigation into thefts reported by people who bought wallets through CryptoBilis, a distributor in Southeast Asia. Investigators described a hidden module with a SIM-style chip tucked into the screen padding. The outer packaging showed no sign of tampering. Mark Karpelès, the former chief executive of the Mt. Gox exchange, posted images of a modified Nano X carrying a circuit board with cellular components. Reports say such a board, if it functions as described, could capture the 24-word recovery phrase that a user writes down during setup.

The attack does not break the wallet's secure chip. Instead, it intercepts the recovery phrase in the supply chain, before the buyer ever uses the device. Anyone who holds that phrase can rebuild the wallet on other hardware and drain it, so the chip's protections stop mattering once the phrase leaves the device. This is a physical supply-chain compromise. The cryptography itself did not fail.

Estimates of the losses differ. The Block and Cointelegraph reported suspected losses above $72 million in one estimate and above $86 million in another, spread across Bitcoin, Ethereum and Tron. Later tallies put the figure at $92 million to $93 million. Ledger has confirmed only one tampered device and has not endorsed any dollar figure. In Cointelegraph's running count, the Ledger thefts make up most of the more than $98 million stolen so far in October. No freezes, recoveries or attribution to a named actor have been reported.

Ledger says the incident appears confined to the reseller and its market, and that "Ledger's infrastructure, systems and services were not compromised." CryptoBilis has stopped selling hardware wallets. Ledger told owners of CryptoBilis devices not to initialize them and advised other users to move funds to a new recovery phrase. Two former CryptoBilis founders, Arravind Prabu and Vimalatheethan, said they sold the company several months before the thefts and have had no access to its systems since March 2026. Corporate records have not yet been published to confirm their account. If it holds, responsibility shifts to the company's new owners.

The open question is whether the tampering spread beyond one region. The researcher 0xJohannes posted photos of a Nano X that he says was bought a few weeks ago from an official reseller in Europe and that contains several extra cables. Ledger has not confirmed that device. A Bitcointalk technical thread is collecting further user reports. Each side of the dispute has an interest here: Ledger benefits if the story stays about one rogue distributor, while competitors and critics of hardware custody benefit if it becomes a story about the whole distribution model.