Who opened your crypto wallet before it reached your hands?

In early October, customers in Southeast Asia discovered that their crypto had disappeared from Ledger hardware wallets that still seemed to be working normally.

They bought the devices through CryptoBilis, an authorized reseller, and believed their private keys were protected inside a device built for that purpose. What they couldn't see was a second piece of hardware, hidden inside the casing, that could steal the information needed to empty the wallet.

On Oct. 10, Ledger confirmed an unauthorized implant in one affected customer's device. Three days later, its security team explained that the added electronics had read the wallet's 24 recovery words as they appeared on the screen during setup and sent them over a mobile connection.

The protected chip, operating system, and transaction signatures were unchanged.

Blockchain analytics firm Bitquery estimates that attackers stole $102 million from 324 wallets across six networks, although Ledger hasn't confirmed that total or established that every loss came from an implanted device.

Hardware wallets don't actually hold crypto. The coins remain on their networks, so the device only protects the private keys used to authorize transactions, keeping those secrets away from malware on an internet-connected phone or computer.

When an owner approves a payment, the wallet signs the transaction without giving the computer those keys. That separation is the product's main promise, but one exception appears before every owner makes a first payment.

During setup, a Ledger wallet displays 24 recovery words, which can recreate the wallet and its keys if the device is lost. Owners are told to write the phrase down, keep it offline, and never share it. Anyone who copies it can restore the same accounts on another device, and the original wallet's PIN will not stop them.

The CryptoBilis implant was designed for that brief moment when the words appeared on the screen. According to Ledger, a small controller intercepted the information being sent to the display, reconstructed the phrase, and transmitted it over LTE using an embedded SIM card.

It didn't need to break the protected chip or trick the owner into entering the words on a fake website.

The owner could finish setup, use the wallet, and approve legitimate transactions, while someone else had an identical way to access the funds. An optional additional passphrase can protect accounts created with it, but for ordinary accounts the recovery words alone are enough.

Ledger's Genuine Check verifies that a device contains an authentic Secure Element, the chip responsible for sensitive security operations. It can identify a counterfeit chip, but it can't inspect every component inside the casing or prove that nothing has been added since manufacture.

Ledger's security documentation warns that physical modifications may escape detection when the original chip remains intact. That's the weakness the implant exploited: the device could truthfully report on its Secure Element while failing to reveal the extra circuitry beside it.

Tibane Labs examined modified Ledger Nano X devices fitted with electronics that monitored signals between the secure chip and the screen. A more sophisticated specimen used a custom board hidden beneath the display and kept the device's original battery, so casual inspection couldn't find it.

Those specimens were separate from the CryptoBilis investigation and don't prove that the same devices or attackers were involved. They do, however, explain why an authentic chip, correct signatures, and a normal-looking wallet are not the same as proof that the entire device is untampered.