Ledger has verified that a hardware modification was present in a Ledger Nano X connected to a multi-chain wallet-drain operation. The alteration, described as an unauthorized electronic module, could capture recovery phrases displayed during setup and transmit them via a cellular link, potentially accounting for up to $93 million in losses across 311 wallets on five different blockchains.
Implant characteristics and suspected capabilities
The hidden component reportedly contains a microcontroller, LTE radio hardware, an antenna and an eSIM, all wired into the device’s display circuitry. investigators believe the arrangement would allow the module to record the seed phrase shown on the screen and send the data over a cellular network, creating a covert channel for theft.
Reseller role and ownership change
The affected Ledger units were purchased through CryptoBilis, a reseller operating in Indonesia, Malaysia and the Philippines. Corporate filings indicate that CryptoBilis transferred all of its shares to an individual named Jiaming on 3 August 2026, with the new address listed in Heilongjiang province, China. While the timing of the sale coincides with the emergence of the exploit reports, authorities have not yet linked the new owner to the hardware alteration.
Ledger’s investigation and response
After examining a device from an impacted user, Ledger concluded that the tampering was limited to the physical hardware and did not involve its firmware or backend services. The company has halted sales of all inventory held by CryptoBilis and is cooperating with law-enforcement agencies. Ledger also stresses that the number of compromised units appears to be small and that the majority of its products remain secure.
Guidance for wallet owners
Users are advised to run Ledger’s authenticity check, inspect devices for any signs of physical interference, and never enter recovery phrases on websites, apps or in support chats. If a device shows any irregularities, owners should cease its use and contact Ledger through official channels. Maintaining offline backups and performing a low-value test transaction before moving larger sums are also recommended practices.
Why it matters
The incident highlights the vulnerability of supply-chain channels for high-value hardware wallets, demonstrating that tampering can occur before a device reaches the end user. It underscores the need for rigorous verification of resale sources and reinforces the broader industry focus on physical security measures alongside software safeguards.
