A group tampered with hardware wallets and sold them at half the price. The interesting detail is after the implant: Ledger''s official verification mechanism cannot detect it.
What happened, as Ledger itself confirmed
Nano X devices sold by CryptoBilis, a reseller operating in Southeast Asia, shipped with an unauthorized hardware implant. Ledger asked the reseller to stop selling on October 9 and confirmed the tampering the next day. Researchers had been showing the implant since September 16.
The implant''s engineering
The attack broke no cryptography. It went to watch the screen: the implant sits behind the display, captures what appears there and the buttons you press, reconstructs the recovery phrase and transmits it over LTE using a two-millimeter eSIM. The component researchers found under the battery is an STM32 microcontroller, along with a shielded LTE module, and to make it fit they swapped the original battery for a smaller one.
The board is industrial production. Researchers describe it as a panelized flex PCB, the kind ordered from a board factory, not handmade assembly. In one variant, the chip and eSIM markings were sanded off to hide part numbers.
The part that changes how you think about verification
Ledger offers a Genuine Check to attest authenticity, and it warns itself that the check does not detect added implants when the original Secure Element remains intact. The seal checks out and the device is compromised, both at the same time.
The damage has two versions. An on-chain analysis reported by the crypto press estimates 92.9 million dollars drained from 311 wallets, a number Ledger does not confirm: it describes the affected volume as limited. What it confirms is the tampering.
Ledger''s own guidance: whoever bought through the affected channel and has not set up yet, do not set up. Whoever already set up, move the assets to a new wallet, with a new recovery phrase.
The lesson applies to any operation
A checking tool an attacker can satisfy verifies nothing, it stamps. It is the question I ask of every control that appears in an audit: who built that tool, what exactly does it measure, and what is it incapable of seeing.
It is the same spirit as the prize with the price in the email: the seal exists, the diligence does not. And it is the same hole the 2026 software supply chain explored, now with solder: when trust is delegated to an artifact, the attacker forges the artifact.
In this story''s devices, the only visible signal was the antenna. The other one was the half price.
Conclusion
A check that passes is not verification: a control is worth what it measures and what it is incapable of seeing, and it is in what it cannot see that the attacker lives. Official channel, physical inspection and a response plan are what remains when the seal is forgeable. The diligence the seal was supposed to represent is still yours.