Former Mt. Gox CEO Mark Karpelès has documented sophisticated hardware implants hidden inside genuine Ledger Nano X devices. These implants are designed to steal recovery seed phrases by watching the screen and sending the words out over a cellular connection. The findings appear on his research page at Tibane Labs and have been shared across multiple posts on X.

The implants do not attack the secure element. Instead, they sit on the display’s data lines and read the pixels as the wallet shows the 24 recovery words during setup. A small board with a microcontroller, an LTE module, an antenna, and an eSIM reconstructs the text and transmits it. Because the secure element itself remains untouched, the device can still pass Ledger’s Genuine Check.

Karpelès showed that the implants have evolved quickly. Early versions used hand-soldered wires and required a smaller battery to fit. Newer versions use neat flexible boards painted to blend with the official hardware. Chip markings are often sanded off. The latest specimens hide under the screen where the protective padding normally sits, making them hard to spot even after the case is opened.

He bought at least one affected device on Amazon Japan from a Chinese third-party seller. The package shipped from Malaysia and arrived with intact shrink wrap. Another specimen came from Yahoo Auctions in Japan. Neither of these specific devices was purchased from CryptoBilis, the authorized Southeast Asian reseller currently under investigation.

Around the same time, Ledger began investigating reports of drained wallets linked to devices sold by CryptoBilis in Malaysia, Indonesia, and the Philippines. On-chain analysts estimated losses in the tens of millions of dollars. Ledger asked CryptoBilis to halt all sales and shipments. The company later confirmed that at least one affected user’s device contained an unauthorized hardware implant.

Ledger has stated that its own systems, infrastructure, and services show no signs of compromise. It has received no reports involving devices bought directly from Ledger. CryptoBilis confirmed it paused sales while the investigation continues. Former co-founders of CryptoBilis said the company changed ownership earlier in 2026.

Technical posts from the community examined the Nordic nRF9151 cellular module found in some implants. It supports LTE-M and NB-IoT, includes its own processor, and could theoretically do more than simple uploads. Firmware analysis is still pending. Karpelès noted that the implants appear designed for repeated deployment rather than one-off modifications.

Users who opened their own Nano X devices for comparison reported that the metal shell can be removed by hand and the internal battery is held by ordinary double-sided tape. This makes physical access relatively easy once someone has the device. The presence of an implant, however, is not guaranteed on every unit. Most devices bought through official channels appear unaffected based on current reports.

The attack is a supply-chain or post-manufacture tampering issue rather than a flaw in Ledger’s firmware or secure element design. Anyone who can intercept a device after it leaves the factory can potentially install such a module if they have the right tools and knowledge. Intact packaging does not rule out tampering.

Summary

Researchers have confirmed physical spy implants in some Ledger Nano X units bought through unauthorized or reseller channels. These implants capture seed phrases from the screen and exfiltrate them over LTE. Ledger is investigating related theft reports tied to the authorized reseller CryptoBilis and has confirmed at least one implant in a customer device. Devices purchased directly from Ledger have not been linked to the issue so far. The secure element remains intact, so standard authenticity checks can still pass.

**What to do if you own a Ledger device**

- Check where and when you bought it. If you purchased from CryptoBilis or any unauthorized seller in the last few months, treat the device as potentially compromised.
- If you have not yet set up the device, do not initialize it. Contact Ledger support through official channels.
- If you already generated a seed on a suspect device, move all assets to a brand-new Ledger purchased directly from ledger.com, using a completely new recovery phrase.
- Never enter your recovery phrase into any website, app, or chat. Ledger will never ask for it.
- Consider physically inspecting a Nano X only if you are comfortable doing so and understand the risks. Look under the screen area for extra boards or unusual wiring. When in doubt, replace the device.
- Buy future hardware wallets only from the manufacturer’s official store. Avoid marketplaces, third-party sellers, and even authorized resellers if you want the lowest risk of post-factory tampering.
- After moving funds, retire or destroy the old device and its recovery phrase.



Sources:

https://x.com/mono_i_love/status/2108697038057820198
https://x.com/crypto_banter/status/2108842415578570874
https://x.com/alex_bitcoin1m/status/2109055132667371592
https://x.com/kevospore/status/2109168484408029559
https://x.com/MagicalTux/status/2109144643405504573
https://www.tibane.net/research/ledger-nano-x-implant
https://x.com/Ledger_Support/status/2108968264055345381
https://www.theverge.com/tech/1009294/ledger-wallet-tampering-suspected-after-reports-of-crypto-thefts
https://cryptobriefing.com/ledger-malaysia-hidden-implant-cryptobilis/
https://u.today/ledger-makes-shocking-discovery-in-crypto-theft-probe