Factory Sealed
Twenty-four words, a ribbon of copper, a thumbnail-sized screen, and a cellular modem nobody ordered, listening in between.
On October 9, wallets tied to devices sold through CryptoBilis, an authorized Ledger reseller in Southeast Asia, started emptying across six chains.
Bitquery's on-chain analysis put the suspected haul at $102 million across 324 wallets, though Ledger has not verified that figure or the number of affected users.
The vault never cracked: Ledger's Secure Element did what it promised, while a planted board read the seed off the display during setup and phoned it home over LTE.
Ledger's own threat model concedes its Genuine Check cannot see added hardware while the original chip stays intact.
None of it was new. In August 2025, a Thai Reddit user flagged suspicious circuitry in a Ledger Nano X; hardware hacker Joe Grand later determined it was an implant and said he briefed Ledger on it in March 2026.
By October, one of Karpelès’s specimens carried a silk-screened part number with a revision tag, and reports had followed the implant into Flex devices, a reported implant in a German MediaMarkt purchase, and an airport buy in Singapore.
Somebody appears to have built a supply chain inside the supply chain, and for over a year much of the closest scrutiny came from independent researchers buying suspect devices through third-party marketplaces.
When the packaging, the reseller, and the authenticity check all said genuine, who was left to tell a buyer the truth?
August 2025. A Reddit user in Thailand bought a Ledger Nano X from an online marketplace, cracked open the case, and found extra circuitry that had no business being there.
He sent the device to Joe Grand, a hardware hacker who had heard rumors of wallet implants for years but had never seen one in the wild.
Grand found an extra board, an antenna, an LTE module, and an eSIM.
The implant waited for setup, copied each character of the recovery phrase as the wallet sent it to the screen, then used the LTE module, antenna, and eSIM to connect to a nearby cell tower and transmit it.
By Grand's account, he ordered eight more Nano X units from Lazada sellers shipping out of Thailand, and four came back implanted.
On March 4, 2026, Grand says, he reported the findings to Ledger and had a Zoom call with a team there. He says Ledger told him it would investigate who was behind the implants, but that he received no follow-up on the investigation until he asked months later.
The answer, as he tells it: Ledger had found no evidence anyone was using the implants to steal crypto.
Grand kept going. He presented the teardown at Tropicon in April and hardwear.io USA in May, then posted the slides and the implant's extracted firmware online.
Conversations moved into a Signal group with Ledger technical staff and a Japan-based researcher who had found implants in wallets of his own.
In September, Mark Karpelès came across Grand’s research, obtained two Ledger wallets, and found implants in both. Each held a newer, cleaner version of the same idea, which he documented on Tibane Labs’ research page and discussed on Twitter.
The teardown and firmware were public by May. Who else was taking notes, and what did Ledger do with the warning?
Bill of Materials
Grand's unit looked like a prototype. A bundle of hand-soldered wires ran from the extra board to the screen, obvious to anyone who opened the case.
The next specimens looked like nobody's weekend project.
One Nano X Karpelès analyzed carried a custom polyimide flex circuit laminated flat across the back of Ledger’s own board and soldered at select points, so no loose wires showed. Under the battery and antenna sat an ST STM32G431KBU6 microcontroller, a 2×2 mm eSIM, and a shielded LTE module, with a smaller replacement battery making room.
Markings suggested assembly no earlier than late December 2025.
Another unit, shipped from Malaysia by a China-based seller on Amazon Japan, arrived at half price. Inside, the flex circuit had been coated black to match the main board, and the part markings scraped off.
The original battery stayed put, and the implant filled the space where foam padding normally cushions the screen. A Nordic nRF9151 modem handled communications.
The only giveaway was a thin black antenna along the top edge, and someone had silk-screened a part number onto it: AC-A2016-NANO-V1.1.
Karpelès read the label as a deliberate product designation. NANO appeared to name the target, he argued, and V1.1 suggested at least one revision had come before it. “That is a production run, not a one-off,” he wrote.
Tibane’s research noted the flex board was panelized, the kind of board a commercial fabrication house turns out, not a hand-built one-off.
The Japan-based researcher bought ten Nano X units from unauthorized sellers, mostly through Amazon Japan, and found implants in every one, spread across five different layouts.
Around July or August, he says, the listings he watched switched from Nano X to Flex, and the two Flex units he bought were implanted too.
Photos of a Ledger Stax with a hidden LTE modem surfaced on Twitter in October; nobody has independently confirmed them.
None of it trips Ledger’s Genuine Check. The company’s own threat model says the test authenticates the Secure Element and cannot detect added hardware sitting beside it.
Karpelès says his black-coated unit arrived in a flawless shrink-wrapped box from Malaysia and passed Ledger’s Genuine Check.
A hobbyist builds one and moves on. What kind of operation pays for a second revision?
Forty-Seven Minutes
The heist started with a withdrawal slip.
On September 24, 14,512 TRX left Bybit and landed in a wallet that funded the thief’s TRON address the next day.
Bybit withdrawal transaction:
b284a2542afed3f5e00a4f9370cae1a9675b94c29967d49d8c45819cb1d7686e
Receiving wallet that funded the TRON control address:
TWGHw7ZsDdXaP6Jw3vJgJ35FHKUvetBf3E
Three minutes before that TRON address got its first funds, the Ethereum control address got its own.
Ethereum control address:
0x381825deb972b3d0a031a9ce86902ac8b22df8f2
Then came the dress rehearsal. Over two weeks, the two control addresses ran 41 test loops, 21 on TRON and 20 on Ethereum: Send a wallet a few dollars and some gas, have it sign an approval, pull the dollars back.
The last two ran 23 seconds apart on October 7.
October 9, 04:59:57 UTC. Thirty TRON wallets added the same new key, weighted to move funds on its own.
Key added to 30 TRON wallets:
TEqZsE39aNXRnuTwrXJ9ooWMc87puuZxpK
Only a wallet’s own key can make that change, so whoever made it already held all thirty. The owners were locked out of their money and didn’t know it yet.
Eight minutes later, the pull began. Thirteen TRON wallets signed the same approval in one block, twelve more in the next, and $29 million in USDT was gone within six seconds of the first signature.
At 05:54 UTC, 111 Bitcoin wallets emptied in a single block.
Inside 47 minutes, the thief had hit TRON, Ethereum, BNB Chain, Polygon, Solana, and Bitcoin.
Bitquery weighed a phishing explanation and rated it unlikely: The choreography belonged to software already holding every key.
Researchers tanuki42 and Specter posted the drain addresses around noon UTC, and Tether started blocking addresses about ten minutes after the first public post. It blocked 37 in all and froze $10 million sitting in 20 of them.
The thief had already parked 23.7 million USDT in USDD, a stablecoin Tether cannot freeze, and over the following days pushed 26.9 million USDT through THORChain for 10,636 ETH.
About 6,840 ETH went through Tornado Cash over five days, with much of it continuing through Zcash. Bitquery and analyst YFarmX matched 39 of the 41 Zcash lots, down to the smallest unit.
The news didn’t stop the drains. At 20:49 UTC on October 9th, nine more TRON wallets lost 8.8 million USDT.
The next afternoon, a victim’s regular payer sent 70,000 USDT to an already-emptied wallet, and the thief took it ten minutes later using the previous day’s approval.
The 203.8 BTC had not moved as of Bitquery’s October 13 analysis.
Karpelès had started posting about the implants on Twitter the day before the drain, and Kim Zetter from Zero Day suggests the attention may have pushed the thief to cash out early.
One actor held the keys to every drained wallet.
Who had access to the devices before they reached their owners?
Change of Ownership
CryptoBilis carried an unrelated complication of its own, and it surfaced only after the drains became public.
On October 9, co-founder Arravind Prabu posted that CryptoBilis had been acquired earlier in the year and that he and his co-founder had “fully stepped down from all operations, system access, and management.”
In a longer statement reproduced by Kim Zetter from Zero Day, Prabu and co-founder Vimalatheethan said the handover was completed in March of 2026 and that they have since had zero access, credentials, visibility, or administrative control over CryptoBilis systems, customer data, or order histories.
The acquisition agreement, Prabu wrote, barred every party from announcing the deal until mid-October 2026. He added that all suppliers had been told about the new management.
He did not name the buyer. Questions, he said, should go to Nicholas Chang, whom older posts describe as CryptoBilis’s marketing director. Chang did not respond to an inquiry from Zero Day.
Corporate filings reported by the Philippine outlet BitPinas fill part of the gap: 100% of CryptoBilis shares moved on August 3, 2026, to an individual listed as “Jiaming,” with a registered address in Heilongjiang, China.
Binance co-founder Changpeng Zhao alleged that hackers had bought the reseller, an allegation for which no public evidence has been published.
Nobody has tied the new owner, the founders, or anyone at CryptoBilis to the implants or the drain.
The ownership trail also cannot carry the whole story, because the timeline does not fit it.
Grand’s Thai implants surfaced in August 2025, seven months before the handover.
The specimens from Japan, Thailand, Singapore, and Germany came through Lazada storefronts, Amazon sellers, an airport retailer in Singapore, and MediaMarkt, not CryptoBilis.
What keeps recurring is geography. Karpelès’s black-coated unit shipped from Malaysia, where CryptoBilis is based.
The Japan-based researcher’s devices arrived from Malaysia, Thailand, and an Osaka shipping hub, the last listing a seller address at a house he says serves as the registered address for numerous companies.
CryptoBilis has since suspended every hardware wallet brand it sells across Malaysia, the Philippines, and Indonesia, closed its physical stores, and brought in outside specialists to review its processes.
One storefront went dark.
Who was still on the receiving end of the implants?
Phone Home
Every implant has to report somewhere, and that is where the trail gets colder and stranger.
The most detailed answer comes from a single source: The Japan-based researcher, who asked Zero Day not to name him. He pulled data from the implants in his own devices and says two things leak out of them.
The first is location. The planted eSIMs work in any country, and an uninitialized one still remembers the last cell tower it touched. Reading those records from his unused wallets, he says, pointed to what he believes are manufacturing hubs. He has not named them publicly.
The second is the destination. Data in the implant firmware, he says, points to command-and-control servers in a Hong Kong data center managed by Alibaba.
By his count, at least 90 implanted Ledgers were sending seed phrases to those servers in June, and he believes the real number is higher. That was roughly four months before the first wallet was drained.
None of it has been independently verified. He could not say whether the same group was behind every design or whether different actors took inspiration from an original design and advanced it.
Karpelès has a theory that fits the evidence without proving it: The implant is itself a product, with its production lines and a manual sold to someone else, who is installing these on ledgers prior to sale.
Grand calls the technique hardware espionage, and the label fits the tradecraft: Covert hardware, concealment, a beacon, and a listening post. The motive, as far as the chain shows, was money.
The tradecraft looked like espionage and the payout looked like theft.
Who was supposed to be guarding the shelf?
Authorized Channels
For years the advice never changed: Buy from the manufacturer or an authorized reseller.
CryptoBilis was authorized. So was MediaMarkt.
Johannes said the Ledger incident was not limited to Asia: Highlighting a device bought from an official reseller in Europe, and found a spy implant that should not be there.
In a follow-up, he identified the seller as MediaMarkt.
Zero Day reports that the purchase was at a German MediaMarkt in August, that Johannes opened the device only after the drain became news, and that he then bought a second unit at another branch and found an implant in that one too.
A MediaMarkt employee told him the device he purchased was not a return, and that returned Ledgers are sent directly back to the manufacturer rather than resold.
On October 11, Ledger had reminded resellers to source only through authorized channels and never restock returns.
On October 13, MediaMarkt Saturn pulled every Ledger product from its stores and website, with Ledger's agreement, after one customer report and no reported losses, according to Ledger.
The same day, Ledger asked resellers in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales of Ledger devices and take the products off the shelves, while stressing it had not verified a drain tied to a device bought outside CryptoBilis.
Trezor moved too, telling an undisclosed number of resellers their authorization ends January 1, 2027.
Chief Commercial Officer Danny Sanders said there was "not a single piece of evidence" that Trezor devices had been compromised.
Grand wrote to Trezor on August 10 about a Model T that someone else had bought through Facebook Marketplace in Canada in 2025. Its microcontroller had been swapped for one that generated one of roughly a dozen attacker-known seed phrases rather than a random one.
Trezor replied within three days and, in September, asked for a heads-up before he published. Both units came from unauthorized sellers, so Trezor's denial holds only if "compromised" excludes hardware tampered with after it left official channels.
A public tracker assembled by Mark Karpelès now offers readers a partial map of the problem: 15 devices from nine named sellers, ranging from a CryptoBilis Stax and MediaMarkt Nano X units to devices bought through Lazada, Amazon Japan, Yahoo! Flea Market, JD.com, a Russian marketplace, and Singapore retailers, including one at the airport.
Most are Ledger devices with an added circuit carrying its own antenna, added after they left the factory, and on the units examined in detail, that circuit reads the recovery phrase off the screen; others are counterfeits with no secure element.
The list covers only publicly reported cases, and one MediaMarkt purchase is still pending examination, but it gives buyers somewhere to check whether their seller or model has already appeared.
Even the warning window lagged. Ledger’s first notice covered only CryptoBilis buyers from the previous 90 days, but Bitquery found more than eight in ten victim wallets were first funded from June onward, before that window began.
By then, the word “authorized” had already failed more than once.
If authorized means a name on a list, what exactly were buyers paying for?
Was self-custody a ruse?
Not quite. But not your keys, not your crypto always assumed the enemy was a custodian.
This attack suggests another: Not your hardware, not your keys either.
The cryptography held. The keys never left the chip.
But the words that could recreate them slipped out through the screen, the one surface built to be read by a human.
Self-custody did not fail because the math broke. It failed because trust was outsourced: to a sealed box, a familiar logo, an authorized name, a supply chain.
Each one became another man in the middle.
The lesson is not that self-custody is worthless. It is that self-custody is only as strong as the least trustworthy link between the factory and your hands.
If you didn’t seal it, ship it, or open it yourself, whose wallet is it really?
REKT는 익명 작성자들에 의한 공공 플랫폼이며, REKT에 작성된 관점이나 내용에 대해서 그 어떤 책임도 지지 않습니다.
기부 (ETH / ERC20): 0x3C5c2F4bCeC51a36494682f91Dbc6cA7c63B514C
disclaimer:
REKT는 당사 웹 사이트의 익명의 작성자 또는 REKT에 의해 게시되거나 관련된 서비스에서 게시되는 콘텐츠에 대해 어떠한 책임도 지지 않습니다. 당사는 익명 작성자들의 행동 및 게시물에 대한 규칙을 제공하지만, 익명의 작성자가 웹 사이트 또는 서비스에 게시, 전송 혹은 공유한 내용을 통제하거나 책임지지 않으며, 귀하가 웹 사이트 또는 서비스에서 직면할 수 있는 불쾌함, 부적절함, 음란함, 불법 또는 기타 해로운 콘텐츠에 대해서도 책임을 지지 않습니다. REKT는 당사 웹 사이트 또는 서비스 사용자의 온라인 또는 오프라인 행위에 대한 책임을 지지 않습니다.