# Hidden Cellular Implants in Ledger Devices Sold by a Malaysian Reseller Are Tied to Up to $93 Million in Thefts

The implant read each recovery phrase off the screen during setup and sent it out over a mobile network without touching the secure chip, and only about $10 million of the stolen funds has been frozen.

- Published: 2026-10-13T05:42:08.752Z
- Canonical: https://polylog.news/crypto/2026-10-13/hidden-cellular-implants-in-ledger-devices-sold-by-a-malaysi
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [Bitcoin Magazine](https://bitcoinmagazine.com/news/ledger-investigates-fund-losses), [CoinDesk](https://www.coindesk.com/tech/2026/10/12/ledger-claims-cryptobilis-cases-are-limited-as-up-to-usd93m-is-traced-usd10m-frozen), [Polylog editors](https://polylog.news), [Bitcointalk Dev & Technical](https://bitcointalk.org/index.php?topic=5596402.0), [BleepingComputer](https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/), [Gizmodo](https://gizmodo.com/ledgers-crypto-wallets-reportedly-backdoored-71-million-in-crypto-already-moved-2000824372), [Crypto Briefing](https://cryptobriefing.com/ledger-reseller-supply-chain-hack-implants/)

Ledger, the French hardware-wallet maker, [confirmed that at least one device sold by CryptoBilis](https://bitcoinmagazine.com/news/ledger-investigates-fund-losses), a reseller based in Kuala Lumpur, contained an unauthorized hardware implant. Buyers in Southeast Asia had reported drained wallets the week before. Ledger told CryptoBilis customers not to set up their devices, and it says the reseller has stopped selling them. Users had already raised concerns about the reseller in a [Bitcointalk technical thread](https://bitcointalk.org/index.php?topic=5596402.0).

The attack did not break Ledger's secure chip or its cryptography. According to [BleepingComputer](https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/), the implant captured the device's display output and button presses during setup. It identified the recovery phrase while the screen showed it and sent the phrase as text over a cellular connection using the technology behind most 4G networks (LTE) and an eSIM. Mark Karpelès, the former chief executive of the collapsed Mt. Gox exchange, examined devices from the reseller. He described the module as LTE components, an antenna, an eSIM and a microcontroller hidden in the buffer pad behind the screen. The implant only listened passively, so the device firmware had no way to detect it. The root cause was a supply-chain compromise: someone physically tampered with retail stock before buyers received it.

On-chain researchers estimate that [$86 million to $93 million was taken from more than 300 wallets](https://t.me/cointelegraph/72625). Analysts cited by [Crypto Briefing](https://cryptobriefing.com/ledger-reseller-supply-chain-hack-implants/) counted 315 wallets across Tron, Bitcoin, Ethereum, BNB Chain, Polygon and Solana, with Tron accounting for about $70.5 million. [CoinDesk reports](https://www.coindesk.com/tech/2026/10/12/ledger-claims-cryptobilis-cases-are-limited-as-up-to-usd93m-is-traced-usd10m-frozen) that about $10 million has been frozen. Tether froze USDT held at attacker addresses. The attackers then began converting USDT into USDD, a Tron-based stablecoin that Tether cannot freeze, and sent 430.2 ETH into the Tornado Cash mixer, [Gizmodo reported](https://gizmodo.com/ledgers-crypto-wallets-reportedly-backdoored-71-million-in-crypto-already-moved-2000824372). No group has been publicly identified as responsible.

Ledger and its critics describe the incident differently. Ledger says every confirmed case involves devices sold by this one reseller, that its own systems were not compromised, and that buyers should avoid unauthorized sellers. Critics quoted by CoinDesk say CryptoBilis operated as an authorized sales channel, which would make the failure Ledger's responsibility. Ledger gains if the incident is treated as one rogue vendor. Competitors and advocates of open hardware gain if it is treated as a flaw in how the industry distributes devices.

This is the third Ledger incident in which the weak point was outside the secure chip. In 2020 a leak of Ledger's customer database exposed buyers' home addresses. In December 2023, attackers inserted malicious code into Ledger's Connect Kit software library and drained users through decentralized applications.

## What this means

A hardware wallet is only as safe as the physical device between the factory and the buyer. Any wallet that shows the recovery phrase on its own screen can be defeated by an implant that reads that screen. The losses fall on holders who bought through third-party retail channels, mostly in Southeast Asia, where official shipping is slow or expensive. Ledger's business also depends on those channels. Ledger wants the incident seen as one rogue vendor. The report that CryptoBilis was an authorized seller weakens Ledger's advice to avoid unauthorized resellers, because buyers did what that advice asks. The common belief that a certified secure chip settles custody risk does not hold here, because the attack never touched the chip. The desk's read is that within months Ledger and its competitors will tighten their reseller lists and add tamper checks and device verification at setup. Over the same period, more cautious holders are likely to move large balances into multisignature setups that use devices from several vendors, or into custodial and exchange-traded products. That read depends on the implants staying confined to CryptoBilis stock. If an implant turns up in a device sold through another channel, the problem would point to manufacturing or logistics, and the move away from relying on a single device would speed up.

## What to watch

- Independent teardowns of Ledger devices bought from other resellers and regions. An implant found outside CryptoBilis stock would place the compromise higher in the supply chain.
- Whether Ledger compensates affected buyers. That decision will show how much responsibility device makers accept for their own sales channels.
- Further freezes by Tether, and any response from USDD's issuer on Tron. The attackers' switch into USDD tests which dollar tokens can actually be frozen.
- Any attribution of the CryptoBilis operation by Malaysian or other law enforcement.