Who Is Planting Backdoors in Ledger Crypto Wallets?

After crypto wallet maker Ledger announced Friday that a backdoor embedded in a handful of Ledger wallets sold in SouthEast Asia allowed thieves to hijack around $102 million in crypto from their owners, news has emerged of other Ledger wallets sold in Germany also having implants.

The hardware implants were originally found on an unknown number of Ledger Nano X wallets sold by an authorized Ledger reseller called CryptoBilis based in Malaysia. Ledger said the implants were found on a limited number of devices, all sold by the same seller. But a Ledger device owner in Europe has since said that he found an implant on a Nano X that he purchased at a large European electronics chain store in August and a second one he purchased this weekend at another store in the same chain. He believes these indicate that Ledger’s supply-chain has been compromised.

Since then, users and researchers have also reported finding implants in Ledger Flex and Ledger Stax devices – two of Ledger's more recent line of devices used for securely storing keys used to access a device owner's crypto accounts.

The implants are not the first to be found on Ledger wallets. Famed hardware hacker Joe Grand found implants on several Nano X wallets earlier this year and notified Ledger about them in March, raising questions about Ledger's urgency in addressing the issue. Many of the implants discovered more recently appear to be more sophisticated iterations of the ones that Grand found.

The implants Grand discovered were also all in wallets sold by unauthorized online sellers who seemingly ran fly-by-night operations that weren’t in business for long. But the implants found in wallets sold by CryptoBilis and the European electronics chain indicate the attackers have switched tactics and may be deliberately compromising wallets sold by authorized resellers now. Ledger and its competitor Trezor have cautioned users for years to buy wallets only from their web sites or from authorized resellers. But the recent compromises indicate that attackers are deliberately targeting authorized sellers to exploit customer trust in them and to get wider distribution for implanted devices. What’s more, the attackers have become more skilled and systematic in their method for compromising the wallets, making it more difficult to detect the implants, Grand and other researchers say.

It's not clear how long the implants have been sitting in the sold devices, but last week a coordinated heist resulted in millions of dollars in crypto being stolen from the device and accountholders. According to blockchain research company Bitquery, crypto was stolen from about 315 accounts connected to compromised CryptoBilis Ledger devices alone, and is currently valued at around $102 million. The stolen funds include Bitcoin, Ethereum and Tron and other cryptocurrencies. Some of the funds have reportedly been frozen in the accounts to which the thieves transferred it, and other funds appear to be in accounts that have been flagged for fraud. And it's not clear if funds were also stolen from Ledger owners who purchased their devices from other sellers.

Ledger, based in France, wrote in statement posted to X that it had asked CryptoBilis to halt all sales and shipments of Ledger devices until it could conduct an investigation. CryptoBilis — which is authorized to sell Ledger wallets in Malaysia, Indonesia and the Philippines — wrote on its web site that it is cooperating with Ledger’s investigation.

But a user going by the name Johannes wrote on X over the weekend that he had purchased a Ledger Nano X wallet in person from a MediaMarkt store that had an implant. MediaMarkt is Germany’s equivalent to BestBuy and has 1,000 stores in ten European countries. It’s listed as an authorized reseller of Ledger wallets in Austria, Germany, Spain and Turkey.

Johannes told Zero Day he purchased the wallet in August in a MediaMarkt store in Germany but only took the device apart this weekend following reports that implants had been found. He posted photos of an antenna and implant in his device. Johannes said that he has had no crypto stolen.

In an update to X this weekend, Ledger suggested the implant problem may stem from authorized resellers obtaining Ledger wallets from illegitimate sources or reselling wallets that were bought and returned to them — after being compromised.

“We are reminding our authorized resellers and distributors to source products only through authorized channels and never to restock returned products,” Ledger wrote. “This is an ongoing threat that doesn’t just impact Ledger, but the whole ecosystem, and we are calling others in the space to work with us on making improvements for users…. Raising the bar on physical supply-chain integrity benefits the entire ecosystem.”

But Johannes, who purchased a second Ledger wallet from another MediaMarkt store on Monday and found an implant in it as well thinks this suggests that Ledger’s supply chain has been compromised.

“This indicates a widespread issue rather than an isolated incident, potentially affecting Ledger inventory across MediaMarkt and Saturn stores throughout Europe,” he wrote on X. He says he initially thought his two compromised devices might have been return items that the store then resold as new, but a MediaMarkt employee told him they were new devices and that returns are sent back to Ledger, not re-sold.

Ledger did not respond to an inquiry from Zero Day, but the company wrote on X that there is currently "no indication that Ledger's security infrastructure, systems or services have been compromised.

The issue raises questions about Ledger’s response to the implants and its transparency to customers. After Grand notified the company last March about implants he found in Ledger wallets, the company told him it would investigate to determine who was behind the implants. But Grand says he never received any followup until months later when he asked about it, and someone at Ledger told him they had found no evidence that someone had used the implants to steal crypto from device owners.

But the situation began to change after this.

In April and May, Grand published his implant findings online and gave two presentations about them at conferences in April and May. Mark Karpelès, a French businessman and former CEO of the infamous bitcoin exchange Mt. Gox who was charged with fraud following the collapse of his business, saw Grand's research online and decided to purchase Ledger wallets to see if he could find implants in them as well. He obtained two wallets and found more advanced iterations of the implant Grand discovered and published his findings online last month.

Karpelès's notoriety in the crypto world caused information about the implants to spread widely in the crypto community, which may be why the heists occurred last week. The attackers may have been waiting until they had amassed many wallets with large balances associated with them before pulling off a widespread heist of funds. But once news about the implants began to spread, this may have spurred the thieves to quickly grab as much crypto as they could from wallets already compromised, before wallet owners could move to protect those funds. Some people online have been praising Karpelès for exposing the implants and an operation that might have gone unnoticed for years until he wrote about it.

Evolving Backdoors

Grand began looking at Ledger wallets in August 2025 after someone published a Reddit post indicating he had found something in his Ledger Nano X wallet. The owner, who purchased the wallet from an online marketplace in Thailand, cracked opened the wallet’s casing and found extra circuitry that should not have been there. He sent the wallet to Grand to see if he could confirm it was a backdoor and determine what it was designed to do.

Inside the device, Grand found an extra board as well as an antenna, LTE module and eSim. He determined that the implant was stealing the recovery seeds of infected wallets and transmitting them to the attackers. The implant would sit silently on the device until the owner initialized it and caused it to generate a random seed phrase – essentially a password stored on the Ledger device to allow the device holder to access their crypto account. As the device sent each character of the seed phrase to the device's small screen to display to the owner, the implant copied them and stored the data before subsequently using the LTE module, antenna and eSIM to connect to a nearby cell tower and transmit the seed to the hackers.

Grand, who runs Grand Idea Studio, was thrilled with the finding because although there have long been rumors and theoretical claims about hardware implants on wallets he had never seen one in the wild. He purchased eight more Ledger wallets from several online sellers in Thailand and found that four of them were compromised with similar implants. All of the ones Grand purchased came from "sketchy" sellers on Lazada, an e-commerce platform in SouthEast Asia that is a subsidiary of the Chinese company Alibaba Group. The devices were shipped from Thailand.

On March 4, Grand reported his findings to Ledger and had a Zoom call with a team there, and subsequently gave two talks about the backdoors at the Tropicon conference in April and at the Hardwear.IO conference in May and posted his slides online. He also continued to have some e-mail conversations with Ledger before moving to a Signal group chat with some technical staff there as well as with a researcher based in Japan who had purchased some wallets through online sellers there in March and found implants in them.

In September, Karpelès saw Grand’s research and obtained two Ledger wallets, including one purchased at half price from a Chinese seller on Amazon that arrived in a “flawless” shrink-wrapped box from Malaysia. He found implants inside both wallets and published his findings last month on the web site for Tibane Labs, which Karpelès owns and uses to conduct blockchain research and produce open-source tools. The implants operated similar to the ones Grand had found, but they were much more sophisticated in their design and more cleverly hidden to make them harder to spot inside a device.

Karpelès said the version Grand found appeared to be a prototype that had evolved over time. That first-generation involved a bundle of hand-soldered wires that stood out to anyone who opened the devices. The wires connected the implant to the Nano’s screen to grab each character of the randomly-generated seed as they were displayed on the screen.

The more advanced implant used an orange-colored, transparent, custom-built flexible circuit laid over the wallet’s original board and laminated flat onto it and soldered in select places, eliminating the need to solder wires that could be easily seen. To make room for the additional circuit, the hackers had replaced the original battery with a smaller one. Based on some markings, the implant appeared to have been assembled in December 2025 or later.

The second implant, which he found in the device shipped from Malaysia, was the most advanced. Inside the wallet, there appeared to be nothing to distinguish it from an unmodified Nano X device. But a thin black antenna running along the top edge of the board was a giveaway. But every other giveaway from the previous design had been eliminated. The orange flex circuit had been coated with the same black color as the legitimate Ledger board, allowing it to blend in with that component. Part numbers were scraped off, and the original battery was still there. The attackers had simply removed some padding that normally sat behind the screen to make room for the implant. Notably, the attackers had silk-screened a parts number — AC-A2016-NANO-V1.1 — onto the antenna, suggesting it was a custom-built component that had been manufactured to hijack Nano wallets at scale.

“‘NANO' names the target,” Karpelès wrote, “and ‘V1.1’ says it has already been through at least one revision. Someone designed and ordered RF parts for this one device. That is a production run, not a one-off.”

This third-generation version of the implant was “not a hobbyist’s build,” he wrote. “A flex PCB keyed to the Ledger’s own parts, a custom antenna already at its second revision, colour-matched coating and scraped markings all point to planning, a real budget, and a goal of mass production.”

On October 8, the day before the crypto heists went public, Karpelès began posting a series of messages on X about his findings and responding to questions about the implants he found. This is when news of the implants began to spread. The next day, news of the crypto heists emerged, raising questions about whether the attention Karpelès brought to the implants caused the attackers to launch their crypto heister sooner than they had originally planned.

Who Is Behind the Compromised Wallets?

Over the weekend, questions have arisen online about the founders of CryptoBilis and the fact that the company quietly switched owners in March — an acquisition that was not publicly disclosed until this weekend when users on X began pointing fingers at the founders and suggesting they might be behind the compromised devices or at least cooperating with the crypto thieves who stole money from the owners of compromised Ledger devices.

CryptoBilis co-founder Arravind Prabu rejected the accusations and revealed that his company had been acquired by someone else earlier this year and that he and his cofounder had “fully stepped down from all operations, system access, and management” in March. When asked why the acquisition was never made public, Prabu claimed in a lengthy statement that the deal was under an NDA until mid-October, which only enhanced suspicions.

“Since the completion of the handover, we have held zero access, credentials, visibility, or administrative control over CryptoBilis backend systems, customer databases, order histories, or corporate communication channels,” Prabu and his cofounder wrote in their statement. “Under the formal acquisition agreements, all parties were contractually bound to hold off on issuing a joint public announcement until mid-October 2026.”

He says that all suppliers — presumably Ledger among them — were “previously notified of the corporate acquisition and new management structure.”

Several people Zero Day spoke with say the months-long silence around the acquisition is "very shady" and question whether this was intended to keep Ledger customers in the dark while the implants spread through online sales. But Prabu says the suspicion, at least against them, is misplaced.

Oddly, Prabu did not identify who acquired CryptoBilis. He wrote that anyone who has questions about Ledger devices sold by CryptoBilis should contact Nicholas Chang. Chang, however, is identified in old postings to Facebook and X as a director of marketing for CryptoBilis, not the owner. Chang did not respond to an inquiry from Zero Day.

There is currently no evidence that anyone associated with CryptoBilis is behind the implants or the heist of cryptocurrency last week.

But the security researcher in Japan who has participated in conversations about the implants with Grand and Ledger since the spring, told Zero Day that he uncovered some intriguing findings from data he extracted from Ledger implants he purchased.

The researcher, who doesn't want to be publicly identified, purchased several Nano X wallets last March for his own use and put them in a drawer, intending to analyze them at some point when he had free time. After seeing Grand post his Tropicon slides online last spring, he took apart his own Ledger devices and found implants in them. He ended up purchasing ten Nano X devices from unauthorized Ledger sellers, most of them through the Amazon marketplace in Japan. One of the devices shipped from Malaysia, several came from Thailand, and two of them were shipped to him from an address in Osaka – essentially a shipping hub. All of them had implants. He found five different versions of implants among them, including the sophisticated implants Karpelès had found, as well as two additional designs.

"Some were very advanced and some were very basic," he says. "When I say versions [I mean] some of the layouts or components are different."

All of the implants operate in similar ways to record the randomly generated seed phrase as it's sent to the compromised device's screen and transmit the data to the attackers. He says he can't tell if the same group is behind all of the designs or if different actors took inspiration from an original design created by one person and advanced it.

In the case of the devices he received from Osaka, the seller's address was listed as a house in another city in Japan. That house, the researcher says, is used as an address for numerous companies engaged in various businesses, including criminal enterprises.

More interesting, he says, is that he was able to trace the transmission of the stolen seed data to servers in Hong Kong. The eSim the attackers planted in Ledger devices is designed to work in any country, and the researcher says that if a device owner doesn't initialize their new wallet, the eSim still retains the location of the last cell tower it connected to, which he was able to extract from the eSims in his wallets.

"This allowed me to find [what I think are] some manufacturing hubs for the implant," he says.

He says additional data contained in the compromised device's microcontroller firmware can be used to trace the location of the command and control servers used to receive the stolen seed phrase. He says he was able to trace the transmissions to servers hosted at a data center in Hong Kong that is managed by Alibaba and determined that in June at least 90 implants on infected Ledger devices were sending seed phrases to those servers, though he thinks the true number of devices communicating with the servers is likely much higher than this.

Pivot to Ledger Flex and Stax Devices

Although most of the compromised Ledger devices so far have been Nano X devices, there is evidence that the attackers have begun to pivot to Ledger Flex and Stax devices. Over the weekend someone posted images of their Stax device on X, which also appears to be compromised. It's not clear if this has been independently confirmed by Ledger or researchers. Separate to this, the researcher in Japan says he purchased two Ledger Flex devices and found implants in them as well.

He says that sometime in July or August he was monitoring a number of online sites that were selling Nano X devices when several of them stopped selling Nano X devices and switched to selling Ledger Flex devices.

"My sense is that they simply developed a new implant that is only for Flex," he says.

He says he has spoken with Japanese law enforcement about his findings as well as with technical contacts at Ledger, but the latter has not shared any information with him about its own investigation.

In the meantime, the list of compromised devices is growing. Over the weekend, Karpelès has been posting information from other Ledger device owners who have since found implants in their devices.