# Ledger confirms a hidden cellular implant in a wallet sold by reseller CryptoBilis as theft estimates reach $93 million

Ledger has verified one tampered device and says its own systems were not breached. But an unconfirmed report of a suspect Nano X bought in Europe challenges the company's view that the problem is confined to one Southeast Asian distributor.

- Published: 2026-10-12T05:41:53.098Z
- Canonical: https://polylog.news/crypto/2026-10-12/ledger-confirms-a-hidden-cellular-implant-in-a-wallet-sold-b
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [crypto.news](https://crypto.news/ledger-confirms-hidden-chip-in-crypto-wallet-amid-92m/), [Polylog editors](https://polylog.news), [Bitcointalk Dev & Technical](https://bitcointalk.org/index.php?topic=5596402.0), [KuCoin News](https://www.kucoin.com/news/flash/ledger-discovers-hidden-chip-in-tampered-hardware-wallets-linked-to-92-93m-in-stolen-funds), [Cointelegraph](https://cointelegraph.com/news/ledger-investigates-fund-losses-linked-to-southeast-asian-reseller-warns-users), [The Block](https://theblock.co/news/business/2026-10-09-ledger-cryptobilis-fund-losses-418163)

Ledger, the French maker of hardware wallets, [confirmed an unauthorized hardware implant](https://crypto.news/ledger-confirms-hidden-chip-in-crypto-wallet-amid-92m/) inside a customer's device. It found the implant during an October 10 investigation into thefts reported by people who bought wallets through CryptoBilis, a distributor in Southeast Asia. Investigators [described a hidden module](https://www.kucoin.com/news/flash/ledger-discovers-hidden-chip-in-tampered-hardware-wallets-linked-to-92-93m-in-stolen-funds) with a SIM-style chip tucked into the screen padding. The outer packaging showed no sign of tampering. Mark Karpelès, the former chief executive of the Mt. Gox exchange, posted images of a modified Nano X carrying a circuit board with cellular components. Reports say such a board, if it functions as described, could capture the 24-word recovery phrase that a user writes down during setup.

The attack does not break the wallet's secure chip. Instead, it intercepts the recovery phrase in the supply chain, before the buyer ever uses the device. Anyone who holds that phrase can rebuild the wallet on other hardware and drain it, so the chip's protections stop mattering once the phrase leaves the device. This is a physical supply-chain compromise. The cryptography itself did not fail.

Estimates of the losses differ. [The Block](https://theblock.co/news/business/2026-10-09-ledger-cryptobilis-fund-losses-418163) and [Cointelegraph](https://cointelegraph.com/news/ledger-investigates-fund-losses-linked-to-southeast-asian-reseller-warns-users) reported suspected losses above $72 million in one estimate and above $86 million in another, spread across Bitcoin, Ethereum and Tron. Later tallies put the figure at $92 million to $93 million. Ledger has confirmed only one tampered device and has not endorsed any dollar figure. In [Cointelegraph's running count](https://t.me/cointelegraph/72607), the Ledger thefts make up most of the more than $98 million stolen so far in October. No freezes, recoveries or attribution to a named actor have been reported.

Ledger says the incident appears confined to the reseller and its market, and that "Ledger's infrastructure, systems and services were not compromised." CryptoBilis has stopped selling hardware wallets. Ledger told owners of CryptoBilis devices not to initialize them and advised other users to move funds to a new recovery phrase. Two former CryptoBilis founders, Arravind Prabu and Vimalatheethan, [said they sold the company](https://t.me/GokuCryptoNews/20943) several months before the thefts and have had no access to its systems since March 2026. Corporate records have not yet been published to confirm their account. If it holds, responsibility shifts to the company's new owners.

The open question is whether the tampering spread beyond one region. The researcher 0xJohannes [posted photos](https://t.me/GokuCryptoNews/20939) of a Nano X that he says was bought a few weeks ago from an official reseller in Europe and that contains several extra cables. Ledger has not confirmed that device. A [Bitcointalk technical thread](https://bitcointalk.org/index.php?topic=5596402.0) is collecting further user reports. Each side of the dispute has an interest here: Ledger benefits if the story stays about one rogue distributor, while competitors and critics of hardware custody benefit if it becomes a story about the whole distribution model.

## What this means

Self-custody depends on the device being clean from the factory to the buyer, and this attack targets that path. The people exposed are hardware-wallet makers and their reseller networks, holders in markets served mainly by third-party distributors, and, indirectly, any holder who generated a seed on a device bought secondhand. Custodial exchanges and exchange-traded funds gain from the resulting doubt. The standard advice to "buy only from authorized resellers" does not settle the matter, because CryptoBilis was itself a channel Ledger could order to stop selling. There is precedent: Kraken Security Labs showed supply-chain implants on the Nano X in 2020, and the 2020 leak of Ledger's customer database was followed by fake "replacement" devices mailed to customers. Neither prior incident changed how most people buy wallets. The likelier outcome within weeks is that Ledger tightens distribution and pushes device-authenticity checks, while the dollar loss estimate stays unconfirmed. This read depends on independent teardowns failing to show that the European device is tampered. A confirmed implant in a European unit bought through an official channel would end the isolated-reseller explanation, and would likely speed the shift of cautious holders toward custodial products over the following months.

## What to watch

- Whether Ledger or independent researchers confirm the European Nano X is tampered. A confirmation would show the problem reaches beyond one Southeast Asian reseller.
- On-chain tracing of the stolen Bitcoin, ether and Tron assets, and any freezes by stablecoin issuers or exchanges. These would show whether the thieves can be identified and whether victims recover funds.
- Corporate filings or police statements on who has owned and run CryptoBilis since March. They would show whether the tampering was an insider operation at the distributor.