Ledger has confirmed the discovery of an unauthorized hardware implant in at least one device connected to the CryptoBilis wallet-draining investigation. The incident carries estimated potential losses of $93 million across 311 wallets on five blockchain networks. The finding establishes that at least one device associated with the case had been physically tampered with.
In a recent update, Ledger said it examined a hardware wallet belonging to an affected customer and discovered an unauthorized electronic component. The device had been purchased through CryptoBilis, a reseller serving customers in Indonesia, Malaysia, and the Philippines.
Former Mt. Gox CEO Mark Karpelès began looking into the incident on October 9, 2026, after receiving a Ledger Nano X from Malaysia that he suspected had been altered. Although the shrink-wrap packaging appeared intact, he reported finding a concealed electronic module behind the screen, occupying the space typically used for protective cushioning.
According to Karpelès, the suspected modification included a microcontroller, LTE connectivity hardware, an antenna, and an eSIM. The component reportedly connected to the device’s display circuitry. He warned that the configuration might allow an attacker to capture recovery phrases displayed during wallet setup and send the information over a cellular network.
Karpelès subsequently continued investigating the component and urged CryptoBilis to examine its remaining inventory for similar alterations. Ledger later confirmed that an unauthorized hardware implant had been found in an affected customer’s device.
The discovery has raised concerns about the security of hardware wallet distribution networks. Consumers often rely on a brand’s reputation and the seller’s identity when assessing a device’s safety. However, the confirmed finding indicates that at least one wallet connected to the investigation had been physically modified before reaching its owner.
CryptoBilis Ownership Transfer Adds to Ledger Investigation
CryptoBilis’ reported ownership change has introduced another issue into the ongoing investigation. According to reports, former co-founders Arravind Prabu and Vimalatheethan said they sold the company in March 2026 and handed over operational control to the buyer.
The former owners reportedly stated that a confidentiality agreement prevented them from announcing the transaction publicly until mid-October. The timing has attracted scrutiny because reports of suspected cryptocurrency theft involving Ledger devices sold through CryptoBilis also emerged in October.
Corporate records cited by BitPinas reportedly show that 100% of CryptoBilis’ shares were transferred to an individual identified as Jiaming on August 3, 2026. The buyer’s registered address was reportedly in Heilongjiang province, China.
The ownership transfer has received renewed attention following Karpelès’ discovery of the suspected implant in a Ledger Nano X. Online commentators also noted that the Chinese characters 假名 (jiǎmíng) can mean “false name.” This linguistic observation, however, does not establish anything about the buyer’s identity or suggest involvement in the incident.
Separately, a community report alleged that a Ledger wallet purchased through MediaMarkt in Europe displayed signs of possible hardware tampering. MediaMarkt is an authorized Ledger reseller in several European markets, including Germany and Austria. Ledger has not confirmed that the device was compromised or linked it to the CryptoBilis investigation.
Images circulated online have also prompted disagreement among observers. Some questioned whether the components shown resembled an authentic Ledger circuit board, while others said they could not identify a modification matching the implant reportedly discovered in Southeast Asia.
Steps Ledger Users Can Take to Secure Their Crypto
The incident underscores the importance of hardware wallet security, regardless of where a device was purchased. There is currently no conclusive evidence that all Ledger devices are affected, so owners should remain alert without assuming that their wallets have automatically been compromised.
Never share your recovery phrase with anyone, including individuals claiming to represent Ledger. Avoid entering it into websites, applications, or support chats. If your device appears physically altered, discontinue its use and contact Ledger through its official website.
Users can follow Ledger’s official genuine-check procedure to assess whether their device passes its authenticity verification. However, a successful check does not guarantee that the hardware has never been physically modified. Authentication checks should therefore be accompanied by visual inspection and attention to official security announcements.
Wallets purchased through questionable or unverified supply channels may warrant additional scrutiny. All users should keep their recovery phrases in secure offline storage, verify transaction information on the device’s own display, and consider sending a small test transaction before transferring larger amounts.
If there is credible reason to believe a recovery phrase has been exposed, do not wait for funds to disappear before responding. Use a trusted, uncompromised device to create a new wallet with a newly generated recovery phrase, then transfer any remaining assets to addresses controlled by that new wallet. Never enter the potentially exposed phrase into a website or software tool in an attempt to secure the funds.
