Author
Ahmed Barakat
Author
Share
Fact Checked by
CryptoNews Editorial Team
Author
Ledger confirmed the exploit; at least one device linked to the CryptoBilis wallet-drain investigation contained an unauthorized hardware implant, with the estimated potential losses reaching $93 million across 311 wallets on five chains. The finding also confirms physical tampering in one affected device, for now.
In an update, Ledger said it had examined a device belonging to an impacted user and found an unauthorized hardware implant. The affected customers had purchased devices through CryptoBilis, a reseller serving Indonesia, Malaysia, and the Philippines.
Ledger said it had contacted affected users and begun working with authorities on this exploit. It also asked CryptoBilis to stop selling all hardware-wallet inventory while the investigation continues, rather than suspending sales of Ledger products alone.
The company’s statement that its systems and services show no sign of compromise points toward a potential physical or reseller-side exposure, not a confirmed breach of Ledger’s backend. That narrows one part of the investigation.
Earn $50 and Enter $300K Prize Draw on EdgeX
One Ledger Exploit and Ex Mt. Gox CEO Finding
Former Mt. Gox CEO Mark Karpelès began investigating the Ledger incident on October 9, 2026, after receiving a Ledger Nano X from Malaysia that he suspected had been physically tampered with. Despite its apparently intact shrink-wrap packaging, Karpelès said he discovered a hidden electronic module concealed behind the screen, where the device’s cushioning normally sits.
Karpelès reported that the suspected implant contained a microcontroller, LTE cellular hardware, an antenna, and an eSIM, with connections to the device’s display circuitry. He believes this configuration could allow the module to capture recovery phrases displayed during wallet setup and transmit the information over a cellular connection.
He also subsequently began examining the component more closely and called on CryptoBilis to inspect unsold inventory for similar modifications. Ledger later confirmed finding an unauthorized hardware implant inside an affected customer’s device
The wider security concern points to the reseller channel: customers may trust a device based on its brand and point of sale, while the confirmed finding shows that at least one device connected to this investigation had been physically altered.
Trade crypto on Bybit and Get a Chance to Win Our $1,000 USDT Airdrop
CryptoBilis Sold to Unknown Buyer?
CryptoBilis’ ownership change has added another layer to the ongoing Ledger hardware wallet investigation. According to reports, the company’s former co-founders, Arravind Prabu and Vimalatheethan, said they completed the sale in March 2026 and handed over operational control.
However, they claimed a confidentiality agreement prevented them from publicly announcing the transaction until mid-October. The timing has attracted attention because the reports of crypto exploits involving Ledger devices sold through CryptoBilis emerged in October.
Corporate records cited by BitPinas reportedly show that 100% of CryptoBilis’ shares were transferred to an individual identified as Jiaming on August 3, 2026. The registered address associated with the buyer was reportedly in Heilongjiang province, China.
The ownership transfer is particularly relevant following former Mt. Gox CEO Mark Karpelès’ discovery of a suspected hardware implant inside a Ledger Nano X. Funny enough, 假名 (jiǎmíng) means false name in Chinese when written in those characters.
For now, investigators still need to establish how the modified devices entered circulation, who installed the components, and whether the ownership change had any connection to the attack. However, there is currently no established evidence linking CryptoBilis’ new owner to the alleged tampering.
European MediaMarkt Report and What Should You Do?
A separate community report alleged that a Ledger bought through MediaMarkt in Europe showed signs of a possible hardware exploit. MediaMarkt is an official Ledger reseller in several European markets, including Germany and Austria, but Ledger has not confirmed that the reported device was compromised or connected it to the CryptoBilis investigation.
Observers also disagreed over what the circulated images showed: some questioned whether the hardware appeared consistent with a genuine Ledger board, while others said they could not identify the same type of implant found in Southeast Asia.
Anyone who owns a Ledger hardware wallet should take this incident as a reminder to review their wallet security, even if they purchased their device directly from Ledger or another authorized retailer. There is currently no conclusive evidence that every Ledger device is affected, so owners should avoid panic and follow official security updates.
Never enter your recovery phrase on a website, in an app, or in a customer support chat, and never share it with anyone claiming to be from Ledger. If your device shows signs of physical tampering, stop using it and contact Ledger support through its official website. A genuine device check alone should not be treated as proof that the hardware has never been modified.
Owners can follow Ledger’s official genuine-check instructions to verify their device’s authenticity. However, passing this check does not guarantee that the device has never been physically tampered with, so users should also watch for signs of modification and follow official security updates. Check Ledger hardware integrity check here.
Hardware wallets purchased through questionable supply chains deserve particular scrutiny, but even owners of unaffected devices should maintain secure offline backups, verify transaction details on the device’s display, and consider a small test transfer before moving substantial funds.
Above all, never wait for confirmation of a theft before acting if there is credible evidence that your recovery phrase has been compromised.
Discover: The Best Token Presales
