Hardware backdoors planted in Ledger crypto wallets were used to steal an estimated $102 million last week, and the compromised devices are not coming from fly-by-night online sellers. They are coming from authorized resellers, including, apparently, one of Europe's biggest electronics chains.
What happened
Ledger announced Friday that implants embedded in a limited number of Nano X wallets sold by CryptoBilis, an authorized reseller based in Malaysia, let thieves hijack crypto from the devices' owners, according to reporting from Zero Day. Blockchain research firm Bitquery says about 315 accounts connected to compromised CryptoBilis devices were drained, with the stolen Bitcoin and Ethereum, as well as Tron and other cryptocurrencies, currently valued around $102 million. Some of the funds have reportedly been frozen in the accounts the thieves moved them to, while other transfers landed in accounts already flagged for fraud. Whether people who bought from other sellers also lost money is still unknown.
The implants go beyond one reseller
A German user going by Johannes wrote on X that he bought a Nano X in August at a MediaMarkt store, opened it up this weekend after the Malaysia reports, and found an antenna and an implant inside. He posted photos, and he says none of his crypto was stolen. On Monday he bought a second Nano X at another store in the same chain. That one had an implant too.
MediaMarkt is Germany's rough equivalent of Best Buy, with 1,000 stores in ten European countries, and it is listed as an authorized Ledger reseller in Austria and Germany, and in Spain and Turkey. Users and researchers have also reported finding implants in Ledger Flex and Ledger Stax, the company's newer devices.
None of this came out of nowhere. Hardware hacker Joe Grand found implants on several Nano X wallets earlier this year and notified Ledger in March. Those devices came from unauthorized online sellers running what Zero Day describes as "fly-by-night operations." Grand and other researchers say the newer implants appear to be more advanced iterations, and that the attackers have become skilled and systematic enough that the modifications are harder to detect.
Ledger's explanation has holes
Ledger said it asked CryptoBilis to halt all sales and shipments while it investigates. CryptoBilis, which is authorized to sell Ledger wallets in Malaysia and Indonesia, as well as the Philippines, says it is cooperating. On X, Ledger floated a theory for how this happened: resellers may be sourcing wallets from illegitimate channels, or reselling returned devices that were compromised after purchase. The company said it is reminding partners to source only through authorized channels and "never to restock returned products," and it called the campaign "an ongoing threat" facing the whole crypto ecosystem.
That theory ran into trouble fast. Johannes says a MediaMarkt employee told him his two devices were new stock, and that returns go back to Ledger rather than being resold. His read, posted to X: this "indicates a widespread issue rather than an isolated incident," potentially touching Ledger inventory at MediaMarkt and Saturn stores across Europe. Ledger did not respond to Zero Day's questions, but wrote on X that there is "no indication that Ledger's security infrastructure, systems or services have been compromised."
I keep coming back to the advice Ledger and Trezor have repeated for years: buy only from the official site or an authorized reseller. That was the entire defense against supply chain tampering, and it was reasonable advice. If attackers are now deliberately working through authorized channels, as this reporting suggests, that defense is gone, and an ordinary buyer has no realistic way to inspect a sealed device for a hardware implant.
Ledger has known about implants since March. The thefts landed in October. The company's insistence that its own systems are untouched may be technically true, but it misses the point. The compromised system is the product sitting on the shelf.
Who is planting these devices, how long they sat in the supply chain, and how many are out there: nobody knows. Anyone holding meaningful keys on a hardware wallet should be sitting with that for a while.