Ledger has verified that an unauthorized electronic implant was found in at least one hardware wallet connected to the CryptoBilis wallet-draining investigation. The suspected incident involves potential losses estimated at $93 million across 311 wallets on five blockchain networks. The discovery confirms that at least one device associated with the case had undergone physical modification.

In a security update, Ledger reported examining a customer’s affected device and finding an unauthorized hardware component. The wallet had been purchased through CryptoBilis, a reseller operating in Indonesia, Malaysia, and the Philippines.

Mark Karpelès, the former CEO of Mt. Gox, started investigating the case on October 9, 2026, after receiving a Ledger Nano X from Malaysia that he believed might have been physically altered. Despite the apparently undisturbed shrink-wrap packaging, Karpelès said he discovered a concealed electronic module behind the screen, in the space ordinarily occupied by protective cushioning.

Karpelès reported that the suspected component contained a microcontroller, LTE cellular equipment, an antenna, and an eSIM. It also appeared to connect with the wallet’s display circuitry. He suggested that the configuration could potentially capture recovery phrases displayed during the device’s initial setup and transmit them through a cellular connection.

He continued examining the suspected implant and asked CryptoBilis to inspect its unsold stock for similar modifications. Ledger subsequently confirmed the presence of an unauthorized hardware implant in a device belonging to an affected customer.

The discovery raises questions about the integrity of hardware wallet supply chains. Buyers may assume that a device is secure because it carries a recognized brand and was purchased from a familiar retailer. However, the confirmed finding demonstrates that at least one device associated with the investigation had been physically altered.

CryptoBilis Sale Raises Questions About Company Ownership

CryptoBilis’ reported ownership transfer has become another point of interest in the investigation into potentially compromised Ledger wallets. According to media reports, the company’s former co-founders, Arravind Prabu and Vimalatheethan, said they sold the business in March 2026 and transferred operational control to the new owner.

The former co-founders reportedly attributed the delayed public announcement to a confidentiality agreement that remained in effect until mid-October. The timing has drawn attention because reports of suspected crypto theft involving Ledger devices distributed by CryptoBilis also surfaced in October.

Corporate records referenced by BitPinas reportedly indicate that the company’s entire shareholding was transferred to an individual identified as Jiaming on August 3, 2026. The buyer’s registered address was reportedly in Heilongjiang province, China.

The ownership change has attracted further scrutiny following Karpelès’ report of a suspected implant inside a Ledger Nano X. Some online discussions also highlighted that the Chinese characters 假名 (jiǎmíng) can mean “false name.” However, this linguistic coincidence provides no evidence about the buyer’s identity, intentions, or connection to the reported incident.

In a separate development, a community report claimed that a Ledger device purchased through MediaMarkt in Europe showed possible signs of hardware tampering. MediaMarkt is an authorized Ledger reseller in several European markets, including Germany and Austria. Ledger has not verified the reported compromise or connected the device to the CryptoBilis investigation.

The images shared online have prompted mixed reactions. Some observers questioned whether the pictured components matched a genuine Ledger circuit board, while others said they could not identify an implant resembling the component reportedly found in Southeast Asia.

Essential Security Measures for Ledger Wallet Owners

The incident serves as a reminder that hardware wallet security deserves attention regardless of where a device was purchased. There is no conclusive evidence that every Ledger device is affected, so users should remain cautious without assuming that all wallets are compromised.

Never disclose your recovery phrase to another person, even if they claim to represent Ledger. Do not type it into websites, mobile applications, or customer support conversations. If your device appears to have been physically modified, stop using it and contact Ledger through its official website.

Ledger’s official genuine-check procedure can help users verify device authenticity. However, passing the check does not establish that the hardware has never been tampered with. Owners should also inspect their devices for suspicious changes and follow official security announcements.

Devices obtained through questionable or unverified distribution channels may require additional scrutiny. As a general precaution, keep recovery phrases securely offline, verify transaction details on the hardware wallet’s own screen, and consider a small test transfer before moving substantial funds.

If you have credible reason to believe your recovery phrase has been exposed, act immediately rather than waiting for a theft to confirm the risk. Create a new wallet using a trusted, uncompromised device and generate a fresh recovery phrase. Transfer any remaining assets to the new wallet, and never enter the potentially exposed phrase into a website or software application while attempting to protect your funds.