Ledger Hardware Implant in Southeast Asia: What We Know and How to Protect Your Coins

On 10 October 2026 Ledger confirmed that a device sold through a Southeast Asian reseller contained an unauthorized hardware implant, after customers reported drained wallets worth tens of millions of dollars. The case is still developing, so this article separates what has been confirmed from what is only claimed, and explains what you should do if you own a Ledger or any other hardware wallet.

The short answer

This looks like a tampered-device supply-chain case, not a hack of Ledger. Customers who bought through one reseller, CryptoBilis, had their wallets emptied from 9 October. Ledger asked the reseller to stop selling, then confirmed a hardware implant in one affected device.

If you did not buy through that reseller, nothing in the public reports says your device is at risk. If you did, do not set the device up, and if you already have, move your coins to a new wallet with a new recovery phrase.

How the case unfolded

The first reports came on 9 October 2026. Customers in Southeast Asia described wallets emptied shortly after setup, and on-chain analysts began tracing the stolen funds. Ledger said it was investigating a specific issue concerning the reseller CryptoBilis and asked it to pause all sales and shipments of Ledger devices.

CryptoBilis is listed as a Ledger reseller for Indonesia, Malaysia and the Philippines, and it also sells hardware wallets from other makers. Mark Karpelès, the former head of Mt. Gox, publicly claimed that devices sold by the reseller had been tampered with and carried spyware.

On 10 October Ledger posted an update confirming an unauthorized hardware implant in the device of one affected user. The reseller suspended its hardware-wallet sales until the investigation ends, and Ledger said it is working with the authorities and thanked the SEAL 911 security group for its help.

What is confirmed and what is not

A story like this moves fast, and rumours travel faster than facts. These are the points that Ledger or several independent sources support.

• Ledger investigated the reseller and asked it to stop selling. Ledger said this itself, and the reseller later suspended hardware-wallet sales.
• Ledger confirmed an unauthorized hardware implant in one affected device. It has not said which model it was, how the part was installed or whether it sent anything out.
• Ledger says it has no indication that its own systems were compromised. It is working on additional anti-tampering measures.
• Large amounts left many wallets in a short time. Several analysts traced the movement across Bitcoin, Ethereum and TRON, even though their totals differ.

Other points are still open, and anyone who states them as fact is guessing.

• Whether the implant explains every theft. Ledger has not tied the one confirmed device to all the losses.
• How many devices and customers are affected. No official number exists.
• Who did it. No group, arrest or seizure has been reported.
• Whether the reseller knew. Whether it was a victim, a negligent link or involved is not established, and we will not guess.

How a hardware implant can steal a recovery phrase

A hardware wallet keeps your keys in a secure chip, but the recovery phrase still has to travel to your eyes. During setup the device shows 24 words on its screen and you write them down. Anything that can read the screen’s data lines at that moment can read the words too, without ever touching the secure chip.

This is the mechanism security researchers have described for this case: a small microcontroller wired to the display, recording the characters shown and sending them out through a cellular link. Karpelès showed images of a device with a small component hidden under the screen area. Ledger has not confirmed these technical details, so read them as a working theory.

The same logic explains why an attacker needs the device before you do. Once you have generated the phrase yourself on an untouched device, an implant added later would have nothing new to record. The risk sits at the moment of setup, which is why a tampered unit is far more dangerous than one bought clean and left on a shelf.

What the inside of a Ledger Nano X should look like

An untouched Ledger Nano X has nothing under its screen. The device has two sides: the component side, with the main chip, the USB-C port and the battery connection, and the screen side, which carries only the OLED display and its connector. The two photos below show an unmodified device opened for reference.

Now compare that with the screen side of a tampered unit. With the display lifted off, three parts show up where an untouched device has only a flat surface: a chip on the left, a Nordic nRF9151 cellular module in the middle and a second chip on the right, next to the display connector. The markings on both chips look ground off, so we have marked them by position and by the Tibane Labs diagram below, not by what is printed on them.

Researchers describe a different picture in a tampered device: lift the screen and an extra board sits underneath. The diagram below credits the Tibane Labs article and users’ disassembly photos, and labels an eSIM, a Nordic nRF9151 cellular module and a second microcontroller under the display, with a coaxial antenna cable along the edge. It is a translated and annotated summary, so read the component placement as indicative and not as an official teardown.

The photo below was shared as the European finding. It shows a Nano X opened up, with red wires soldered to the battery’s protection board, a black coaxial cable ending at a soldered pad on the case, and what looks like a second board beneath the main board. The battery label also differs from the reference unit above, which alone proves nothing. We cannot verify who took the photo or when, and Ledger has not commented on it.

How much was taken

There is no official total. Independent analysts counted the stolen funds on-chain, and their figures differ because they group wallets differently and price the assets at different moments.

Most of the value moved on Ethereum, TRON and Bitcoin, with Bitquery also naming BNB Chain and Polygon. Some of the stolen Tether has been frozen, and tracking firms report part of the Ether going into mixing services, which makes recovery harder with every hour.

The report from Europe

One person reported on social media that a Ledger bought a few weeks ago from a European reseller contained a similar implant. The post described unusual wiring that a normal device does not have, and said no funds had been stolen from it.

This is the weakest part of the story. No reseller or country was named, no photo has been verified by Ledger or by us, and Ledger has not commented. If it holds up, it would mean the problem is not confined to Southeast Asia, so it deserves attention without being treated as established.

If you own a Ledger: what to do now

The steps depend on where the device came from, and they follow Ledger’s own published guidance.

Move the funds in a calm order: send a small test amount first, confirm it arrives, and then move the rest. Do it from a clean computer, and ignore any link in a message that tells you to hurry.

Why miners should care

A miner’s whole output ends up in an address, and the address comes from a wallet. Pool payouts, solo block rewards and rental income all go to whatever address you give the pool. If the phrase behind that address was recorded at setup, every future payout belongs to someone else.

Miners also buy hardware from resellers, the same kind of channel that failed here. The lesson applies to an ASIC just as it does to a wallet: the cheapest or the most convenient seller is not always the safe one.

How to buy and set up a hardware wallet safely

None of these steps is complicated, and together they would have prevented almost every theft described here.

• Buy from the maker or an official reseller. Open the maker’s own site and follow its link to the reseller list, never a link from an ad or a message.
• Inspect the box and the device. Look for broken seals, signs of glue or tools, a device that is already set up, or a card with words already written on it.
• Generate the phrase yourself. A phrase that came on a card, a PDF or a message is never yours alone, so reject any device that arrives with one.
• Write the phrase on paper, once, away from cameras. Never photograph it, type it into a phone or store it in a cloud note.
• Send a small test amount before the real one. Also confirm the address on the device screen, not only on your computer.
• Split larger sums. Use more than one wallet for large holdings, so one failure does not take everything.

The same care applies when you buy mining hardware. Our buying guide explains how to judge a seller, and the vendor pages show who is verified on this site. ASIC Miner Buying Guide: What to Check Before You Pay · Verified ASIC Miner Vendors

The scams that follow the headlines

Every incident like this brings a second wave of fake help. Researchers have already warned about fake search ads, fake migration apps and messages that promise to recover stolen funds for a fee.

• Ledger will never ask for your 24-word recovery phrase, by message, call, form or app.
• Support never contacts you first. Go to the official site yourself and type the address by hand.
• A recovery service that asks for an upfront fee or for access to your wallet is a second theft.
• Download wallet software only from the maker’s official site, and check the address twice.

Earlier Ledger incidents, for context

This is not Ledger’s first security headline, but it is a different kind of problem from the earlier ones.

• December 2023: a malicious software library. A compromised release of Ledger’s Connect Kit was used to drain wallets for a few hours before it was replaced.
• January 2026: an exposure at a payment partner. A breach at the partner Global-e exposed order data of Ledger customers. Payment data and recovery phrases were not affected, but phishing followed.
• October 2026: tampered devices in one sales channel. The current case involves physical modification before the device reaches the customer.

These articles and pages go further on wallets, pools and safe setups. How to Set Up an ASIC Miner: Power, Network, Pool and Cooling, Step by Step · Bitcoin Mining Pools Explained: The Largest Pools, Fees and Payout Methods · Is Solo Mining Worth It? The Honest Bitcoin Odds in 2026 · Crypto Mining Pools · Bitcoin Mining Calculator

Bottom line

A hardware wallet is only as trustworthy as the path it took to reach you. The Ledger case shows that a genuine brand can still arrive modified through a weak link in the sales chain.

Buy direct, create your own phrase, test with small amounts and ignore anyone who offers help unasked. If you bought through the reseller named in this story, move your coins now, and follow only Ledger’s official instructions.