A crypto wallet can pass an authenticity check and still contain malicious hardware.
Ledger has confirmed finding an unauthorized hardware implant during an investigation into cryptocurrency thefts involving its devices. The company linked the confirmed cases under investigation to CryptoBilis, an authorized reseller whose sales Ledger has suspended.
According to BleepingComputer, researchers examining modified devices found additional circuitry capable of capturing sensitive wallet information. The point at which the devices were tampered with remains unclear.
The incident highlights a supply-chain security risk: even devices designed to protect sensitive information can be compromised if attackers gain physical access before they reach users.
What is a hardware wallet, and why does this really matter
A hardware wallet is a physical device that stores the cryptographic keys used to authorize cryptocurrency transactions, keeping them isolated from internet-facing computers and phones. Unlike an exchange account, where a third-party typically holds the keys, a hardware wallet gives users direct control over their assets. That alone makes hardware wallets secure by design.
However, protection depends on more than the device’s design.
Ledger's investigation illustrates how attackers could bypass that assumption by adding unauthorized components capable of capturing sensitive information. The device may continue functioning normally, making the compromise difficult for users to recognize.
How the hardware implant reportedly worked
Reports from Ledger customers in Southeast Asia prompted the company to investigate devices in that region, where it later determined that all affected customers had their devices from one of its authorized resellers — CryptoBilis.
On Oct. 9, Ledger announced on X that it had paused sales from CryptoBilis while investigations continued. Per BleepingComputer, the company’s investigations later determined that at least one affected customer’s wallet contained an unauthorized hardware implant.
Security researchers examining modified Ledger Nano X devices, as cited by BleepingComputer, found additional circuitry designed to capture wallet information. The reported implant identifies recovery phrases and transmits the captured information using an eSIM.
With the recovery phrase, a threat actor can restore the wallet elsewhere and drain the funds.
Ledger implements anti-tamper protection on its wallets. However, the malicious implants at the heart of this incident still ran because of a limitation in Ledger’s Genuine Check design. The company notes that a check can’t detect unauthorized modifications if the original Secure Element remains intact.
That suggests the actors involved did a careful job with the modification. While Ledger has not officially confirmed the total amount stolen, blockchain tracking firms and industry outlets estimate user losses have exceeded $86 million.
What users and organizations should do
The incident highlights a distinction between authentic hardware and hardware that has remained physically secure throughout distribution.
For cryptocurrency users, purchasing from trusted sellers and following manufacturer verification guidance can help reduce exposure to tampered devices. Unusually low prices or unexpected changes to packaging may warrant additional scrutiny, although their absence does not guarantee safety.
Anyone who suspects their device has been compromised should stop using it and contact the manufacturer through official support channels. If a recovery phrase may have been exposed, the wallet itself should be treated as compromised rather than relying solely on a replacement device.
For enterprises, the same risk extends beyond cryptocurrency wallets. Organizations that depend on third-party suppliers for hardware and even software could inherit vulnerabilities introduced before those products reach their premises. A compromised component may undermine otherwise sound security controls, expose sensitive data, or give attackers a foothold inside corporate systems.
Supplier vetting, product provenance, tamper-evident packaging, and hardware verification can reduce these risks. But no single check guarantees that a product is free from malicious modifications.
A successful authenticity check can establish that certain components are genuine, but it cannot necessarily prove that nothing else has been added. That gap makes supply-chain integrity an essential part of hardware security.
Other news: Attackers are actively exploiting CVE-2026-85097, a critical vulnerability in the Bricksforge WordPress plugin that allows unauthenticated remote code execution.