Ledger has confirmed that some of its hardware wallets distributed through Southeast Asian reseller CryptoBilis were compromised with a hardware implant that drained users' cryptocurrency funds. On 9 October Ledger launched an investigation into reports of losses and asked CryptoBilis to stop selling its devices; the following day it confirmed an "unauthorised hardware implant" in at least one impacted user's device, describing the affected volume as "limited" and updating again on 11 October that all reported fund drains traced to CryptoBilis-sold devices. Researchers (including former Mt. Gox CEO Mark Karpelès and Tibane Labs) showed implants in Ledger Nano X hardware — a hidden ST STM32G431KBU6 microcontroller, a tiny 2×2 mm eSIM and a shielded LTE module that captures display output and button presses to obtain the seed phrase and transmit it to the attacker. Two implant variants were documented, one in a device bought on Amazon Japan from a China-based seller shipped from Malaysia. Ledger advises anyone who bought from CryptoBilis not to initiate setup and to move assets to a new seed if already configured.

• Source article