{"id":79339,"date":"2026-10-10T20:14:19","date_gmt":"2026-10-10T20:14:19","guid":{"rendered":"https:\/\/crowdfundjunction.com\/blog\/ledger-confirms-hidden-hardware-implant-in-affected-users-wallet\/"},"modified":"2026-10-10T20:14:19","modified_gmt":"2026-10-10T20:14:19","slug":"ledger-confirms-hidden-hardware-implant-in-affected-users-wallet","status":"publish","type":"post","link":"https:\/\/crowdfundjunction.com\/blog\/ledger-confirms-hidden-hardware-implant-in-affected-users-wallet\/","title":{"rendered":"Ledger Confirms Hidden Hardware Implant in Affected User&#8217;s Wallet"},"content":{"rendered":"<p><b>(Originally posted on : Bitcoin News )<\/b><br \/>\n<\/p>\n<div>\n<div class=\"@container mb-[25px] rounded-sm overflow-clip py-0.5 pr-0.5 pl-2.5 bg-success-100\">\n<div class=\"flex flex-col gap-m overflow-clip rounded-[6px] !bg-success-10 p-3 @[420px]:p-m\">\n<h2 class=\"m-0 flex items-center gap-s text-[19px] !text-[#1c1c1c] md:text-[20px]\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"16\" height=\"10\" viewbox=\"0 0 16 10\" fill=\"none\" class=\"shrink-0 text-success-100\" aria-hidden=\"true\"><path d=\"M1 1.5h14\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><path d=\"M1 8.5h10\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><\/svg><span>Key Takeaways<\/span><\/h2>\n<ul class=\"m-0 flex list-none flex-col gap-m pl-0\">\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Ledger confirmed an unauthorized hardware implant on Oct. 10, strengthening suspicions of physical tampering.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Yfarmx estimates $93.4 million in suspected losses, but Ledger has yet to verify the figure.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">CryptoBilis has halted hardware wallet sales as Ledger works with authorities to investigate the incident.<\/span><\/li>\n<\/ul>\n<\/div>\n<\/div>\n<h2>Ledger Confirms Physical Tampering as Crypto Wallet Investigation Widens<\/h2>\n<p><a href=\"https:\/\/x.com\/Ledger_Support\/status\/2108968264055345381?s=20\" target=\"_blank\" rel=\"noopener noreferrer\">On Saturday, Oct. 10, Ledger confirmed<\/a> that an affected customer\u2019s device contained an unauthorized hardware implant, a discovery that lends considerable weight to suspicions surrounding the recent wallet-draining episode linked to Southeast Asian reseller CryptoBilis. The confirmation follows estimates of losses reaching $93.4 million, although Ledger has not independently verified those figures.<\/p>\n<p>The company also maintains that its security infrastructure remains intact, leaving investigators with a rather peculiar problem: a potentially compromised device that could still appear genuine. Ledger\u2019s Saturday statement marked the first company confirmation <a href=\"https:\/\/news.bitcoin.com\/security\/ledger-wallet-mystery-deepens-as-suspected-losses-hit-93-4m\/\">of physical tampering<\/a> involving an affected customer\u2019s hardware wallet. The manufacturer announced that \u201cone of the impacted users\u2019 devices contained an unauthorized hardware implant,\u201d giving investigators their strongest evidence yet that malicious hardware entered the picture.<\/p>\n<p>In the X post, the company\u2019s support account explained that it was \u201creaching out to impacted users as part of the ongoing investigation,\u201d while encouraging anyone possessing relevant information to contact its bounty program. CryptoBilis has also taken action, with Ledger reporting that the reseller \u201chas ceased sales of all hardware wallet inventory until the investigation is concluded.\u201d<\/p>\n<p>The confirmation follows <a href=\"https:\/\/news.bitcoin.com\/security\/ledger-investigating-86m-drained-crypto-hardware-wallets\/\">Friday\u2019s reports of drained wallets<\/a> across Southeast Asia, where investigators traced suspicious transactions involving bitcoin, ether, and stablecoins. Independent estimates have ranged considerably, with Yfarmx placing suspected losses at $93.4 million across 471 addresses and Bitquery estimating approximately $92.9 million across 311 unique addresses.<\/p>\n<h2>Hidden Hardware Raises Questions About Wallet Security<\/h2>\n<p>The discovery also lends credibility to independent findings published by <a href=\"https:\/\/news.bitcoin.com\/former-mt-gox-ceo-mark-karpeles-assures-no-imminent-bitcoin-sale-everything-is-fine\/\">former Mt Gox CEO<\/a> Mark Karpel\u00e8s, who documented a modified Ledger Nano X containing a concealed circuit board, cellular communications equipment, and components allegedly capable of intercepting recovery phrases.<\/p>\n<p>The alleged trick was particularly clever. Rather than attacking the wallet\u2019s secure element, the equipment reportedly monitored information traveling to the device\u2019s display during setup, potentially capturing recovery words before transmitting them through a cellular connection.<\/p>\n<p>That approach could allow an otherwise authentic device to pass conventional verification checks while secretly exposing its owner\u2019s recovery phrase. However, investigators have not established that every affected wallet contained comparable equipment.<\/p>\n<p><a href=\"https:\/\/news.bitcoin.com\/philadelphia-musician-g-love-loses-nearly-6-btc-to-fake-ledger-wallet-app-on-apples-app-store\/\">The hardware wallet manufacturer Ledger<\/a> sought to draw a distinction between tampered hardware and its underlying security systems, stating, \u201cWe have no indication that Ledger\u2019s security infrastructure, systems or services have been compromised.\u201d<\/p>\n<figure id=\"attachment_855033\" aria-describedby=\"caption-attachment-855033\" style=\"width:1352px\" class=\"wp-caption aligncenter\"><figcaption id=\"caption-attachment-855033\" class=\"wp-caption-text\">Several accounts on X took issue with Ledger\u2019s explanation of the situation.<\/figcaption><\/figure>\n<p>Ledger\u2019s X post drew a great deal of criticism, and some were less than pleased with Ledger\u2019s handling of the situation. The X post features <a href=\"https:\/\/x.com\/ronelmekiesse\/status\/2108971076923572635?s=20\" target=\"_blank\" rel=\"noopener noreferrer\">several accounts asking<\/a>, \u201cAre you gonna refund the victims?\u201d Others said they believe Ledger is responsible for its outsourcing. \u201cIsn\u2019t this your responsibility since they were official authorized reseller from you? You bear that responsibility to compensate victims,\u201d <a href=\"https:\/\/x.com\/1ddenis1\/status\/2108971215473836377?s=20\" target=\"_blank\" rel=\"noopener noreferrer\">another individual wrote<\/a> on Ledger\u2019s X thread.<\/p>\n<h2>Ledger Issues Fresh Warning to CryptoBilis Customers<\/h2>\n<p>With the investigation gathering steam, Ledger reiterated its advice to customers who purchased devices through the reseller. The company recommended that affected purchasers \u201cnot initiate set up if they have not yet done so.\u201d<\/p>\n<figure id=\"attachment_855032\" aria-describedby=\"caption-attachment-855032\" style=\"width:1342px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-855032 size-full\" title=\"Ledger Confirms Hidden Hardware Implant in Affected User's Wallet\" src=\"https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/10\/screenshot-2026-10-10-at-2-49-54-pm.png\" alt=\"X screenshot. \" width=\"1342\" height=\"282\" srcset=\"https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/10\/screenshot-2026-10-10-at-2-49-54-pm-300x63.png 300w, https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/10\/screenshot-2026-10-10-at-2-49-54-pm-1024x215.png 1024w, https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/10\/screenshot-2026-10-10-at-2-49-54-pm-768x161.png 768w, https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/10\/screenshot-2026-10-10-at-2-49-54-pm.png 1342w\" sizes=\"auto, (max-width: 1342px) 100vw, 1342px\"\/><figcaption id=\"caption-attachment-855032\" class=\"wp-caption-text\">A great deal of X accounts asked Ledger if the losses would be compensated.<\/figcaption><\/figure>\n<p>For customers who have already initialized their wallets, Ledger advised them to \u201cconsider moving assets to a new Ledger signer (with a new seed).\u201d The distinction matters because a recovery phrase captured during setup can potentially expose assets long after the compromised hardware has been disconnected.<\/p>\n<p>Ledger also confirmed that it was \u201cworking on further, enhanced anti-tampering solutions,\u201d suggesting that physical modifications capable of evading existing checks have become an immediate security concern.<\/p>\n<p>The company <a href=\"https:\/\/x.com\/SEAL_911\" target=\"_blank\" rel=\"noopener noreferrer\">thanked SEAL 911<\/a> for assisting investigators and said it was cooperating with authorities. Meanwhile, Ledger warned customers that \u201cLedger will never ask for your 24-word recovery phrase.\u201d<\/p>\n<p>For all the developments, the biggest questions remain unanswered. One compromised device is now confirmed, but the number of additional implants, their connection to the reported losses, and the identity of those responsible remain unresolved. A device built to keep secrets apparently had a second set of ears, and investigators are still determining how many others might have been listening.<\/p>\n<div class=\"not-prose my-3 lg:my-4\">\n<div class=\"overflow-hidden rounded-lg !bg-[#E8EDFA] p-[9px] hidden md:flex md:flex-row md:gap-3 lg:hidden\"><a aria-hidden=\"true\" tabindex=\"-1\" class=\"relative size-[150px] min-w-[150px] shrink-0 overflow-hidden rounded-[15px]\" href=\"https:\/\/news.bitcoin.com\/ledger-wallet-mystery-deepens-as-suspected-losses-hit-93-4m\/\"><img alt=\"Ledger Wallet Mystery Deepens as Suspected Losses Hit $93.4M\" loading=\"lazy\" decoding=\"async\" data-nimg=\"fill\" class=\"object-cover\" style=\"position:absolute;height:100%;width:100%;left:0;top:0;right:0;bottom:0;color:transparent\" sizes=\"150px\" srcset=\"\/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2023%2F08%2Fgfhdkkskkd-150x150.jpg&amp;w=32&amp;q=75 32w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2023%2F08%2Fgfhdkkskkd-150x150.jpg&amp;w=48&amp;q=75 48w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2023%2F08%2Fgfhdkkskkd-150x150.jpg&amp;w=64&amp;q=75 64w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2023%2F08%2Fgfhdkkskkd-150x150.jpg&amp;w=128&amp;q=75 128w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2023%2F08%2Fgfhdkkskkd-150x150.jpg&amp;w=256&amp;q=75 256w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2023%2F08%2Fgfhdkkskkd-150x150.jpg&amp;w=384&amp;q=75 384w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2023%2F08%2Fgfhdkkskkd-150x150.jpg&amp;w=640&amp;q=75 640w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2023%2F08%2Fgfhdkkskkd-150x150.jpg&amp;w=828&amp;q=75 828w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2023%2F08%2Fgfhdkkskkd-150x150.jpg&amp;w=1080&amp;q=75 1080w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2023%2F08%2Fgfhdkkskkd-150x150.jpg&amp;w=1200&amp;q=75 1200w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2023%2F08%2Fgfhdkkskkd-150x150.jpg&amp;w=1920&amp;q=75 1920w\" src=\"https:\/\/news.bitcoin.com\/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2023%2F08%2Fgfhdkkskkd-150x150.jpg&amp;w=1920&amp;q=75\"\/><\/p>\n<div class=\"absolute left-2 top-2\"><img alt=\"Bitcoin.com News\" loading=\"lazy\" width=\"28\" height=\"28\" decoding=\"async\" data-nimg=\"1\" class=\"size-7\" style=\"color:transparent\" srcset=\"\/_next\/image\/?url=%2Fimages%2Fuploads%2Fbitcoin_news_newlogo.svg&amp;w=32&amp;q=75 1x, \/_next\/image\/?url=%2Fimages%2Fuploads%2Fbitcoin_news_newlogo.svg&amp;w=64&amp;q=75 2x\" src=\"https:\/\/news.bitcoin.com\/_next\/image\/?url=%2Fimages%2Fuploads%2Fbitcoin_news_newlogo.svg&amp;w=64&amp;q=75\"\/><\/div>\n<p><\/a><\/div>\n<div class=\"overflow-hidden rounded-lg !bg-[#E8EDFA] p-[9px] hidden lg:flex lg:flex-row lg:gap-4\"><a aria-hidden=\"true\" tabindex=\"-1\" class=\"relative size-[150px] min-w-[150px] shrink-0 overflow-hidden rounded-[15px]\" href=\"https:\/\/news.bitcoin.com\/ledger-wallet-mystery-deepens-as-suspected-losses-hit-93-4m\/\"><img alt=\"Ledger Wallet Mystery Deepens as Suspected Losses Hit $93.4M\" loading=\"lazy\" decoding=\"async\" data-nimg=\"fill\" class=\"object-cover\" style=\"position:absolute;height:100%;width:100%;left:0;top:0;right:0;bottom:0;color:transparent\" sizes=\"150px\" srcset=\"\/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2023%2F08%2Fgfhdkkskkd-150x150.jpg&amp;w=32&amp;q=75 32w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2023%2F08%2Fgfhdkkskkd-150x150.jpg&amp;w=48&amp;q=75 48w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2023%2F08%2Fgfhdkkskkd-150x150.jpg&amp;w=64&amp;q=75 64w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2023%2F08%2Fgfhdkkskkd-150x150.jpg&amp;w=128&amp;q=75 128w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2023%2F08%2Fgfhdkkskkd-150x150.jpg&amp;w=256&amp;q=75 256w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2023%2F08%2Fgfhdkkskkd-150x150.jpg&amp;w=384&amp;q=75 384w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2023%2F08%2Fgfhdkkskkd-150x150.jpg&amp;w=640&amp;q=75 640w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2023%2F08%2Fgfhdkkskkd-150x150.jpg&amp;w=828&amp;q=75 828w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2023%2F08%2Fgfhdkkskkd-150x150.jpg&amp;w=1080&amp;q=75 1080w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2023%2F08%2Fgfhdkkskkd-150x150.jpg&amp;w=1200&amp;q=75 1200w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2023%2F08%2Fgfhdkkskkd-150x150.jpg&amp;w=1920&amp;q=75 1920w\" src=\"https:\/\/news.bitcoin.com\/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2023%2F08%2Fgfhdkkskkd-150x150.jpg&amp;w=1920&amp;q=75\"\/><\/p>\n<div class=\"absolute left-2 top-2\"><img alt=\"Bitcoin.com News\" loading=\"lazy\" width=\"28\" height=\"28\" decoding=\"async\" data-nimg=\"1\" class=\"size-7\" style=\"color:transparent\" srcset=\"\/_next\/image\/?url=%2Fimages%2Fuploads%2Fbitcoin_news_newlogo.svg&amp;w=32&amp;q=75 1x, \/_next\/image\/?url=%2Fimages%2Fuploads%2Fbitcoin_news_newlogo.svg&amp;w=64&amp;q=75 2x\" src=\"https:\/\/news.bitcoin.com\/_next\/image\/?url=%2Fimages%2Fuploads%2Fbitcoin_news_newlogo.svg&amp;w=64&amp;q=75\"\/><\/div>\n<p><\/a><\/p>\n<div class=\"flex min-w-0 flex-1 flex-col justify-center gap-2\">\n<p class=\"m-0 line-clamp-2 text-base leading-[1.3] !text-[#67656E]\">On Friday, the crypto community finds itself confronting yet another security controversy, this time involving hardware wallet manufacturer Ledger. Although\u2026<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<p><a href=\"https:\/\/news.bitcoin.com\/security\/ledger-confirms-hidden-hardware-implant-in-affected-users-wallet\/\">Source link <\/a><br \/>\n<br \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>(Originally posted on : Bitcoin News ) Key Takeaways Ledger confirmed an unauthorized hardware implant on Oct. 10, strengthening suspicions of physical tampering. Yfarmx estimates $93.4 million in suspected losses, but Ledger has yet to verify the figure. CryptoBilis has halted hardware wallet sales as Ledger works with authorities to investigate the incident. Ledger Confirms [&hellip;]<\/p>\n","protected":false},"author":19,"featured_media":79340,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[32],"tags":[],"_links":{"self":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/79339"}],"collection":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/comments?post=79339"}],"version-history":[{"count":0,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/79339\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media\/79340"}],"wp:attachment":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media?parent=79339"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/categories?post=79339"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/tags?post=79339"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}