On October 10, Ledger confirmed that a signer bought through CryptoBilis, a Southeast Asian retailer, contained ‘an unauthorized hardware implant,’ BleepingComputer reported. Ledger has not named the model or described the board it found. Mark Karpelès and Tibane Labs, who took apart units they identified as Nano X devices, describe a microcontroller hidden behind the screen that captured the display and button presses, then sent the seed out over an LTE modem with an eSIM. Galaxy's Alex Thorn estimated about $91 million drained across 477 addresses, roughly 213 BTC of it in bitcoin, according to CryptoSlate. Ledger has validated none of those figures and calls the volume of affected devices ‘limited.’
The secure element and the firmware both held. Someone opened a box, added a part, closed it, and let the owner type the secret in.
What a passed check proves
Ledger's own device genuineness threat model states the limit. Genuine Check verifies that the secure element holds a key Ledger signed. It ‘cannot detect unauthorized physical modifications to the hardware,’ spying implants included, if the original secure element remains intact. It ‘cannot verify the device's physical supply chain history.’ The same page warns that holographic seals ‘can give a false sense of security.’
Ledger is not alone in saying this. BitBox's packaging guide states that a successful attestation check ‘does not prove that a genuine device has never been physically modified.’ Coinkite tells COLDCARD buyers that its numbered bag and boot check do not replace buying from a known source. Every vendor's software check answers one question: did we make this chip? None of them can answer the question that matters this month: who held the box between the factory and you?
The implants also did not stay in one channel. CryptoSlate describes CryptoBilis as an authorized reseller. Tibane's two specimens came from Japanese marketplaces. Karpelès said his came via a Chinese seller, shipped from Malaysia. Ledger told The Record it is ‘also reviewing reports of implants in other signers and locations.’
The intake audit
Set aside one evening. Take every signer you own out of the drawer, including the spare, the old one holding a forgotten balance, and the cosigner in your multisig. For each one, run these steps:
1. Write down the chain of custody. Who sold it, on what date, and whether the seller was the manufacturer itself. A marketplace listing, a used unit, a gift or a ‘sealed’ discount counts as unknown provenance. Coinkite's FAQ says: “You should never buy a 'used' COLDCARD from eBay or another online store." Trezor's support page says to never buy from an unauthorized third party.
2. Check it against the vendor's own list. Ledger's buying guide tells you to match the marketplace ‘Sold by’ name against its official reseller list. Trezor publishes its resellers. A seller missing from the list moves the device to unknown.
3. Recall how it arrived. A legitimate Ledger ‘never comes with a recovery phrase or PIN code pre-configured.’ A Trezor Safe 3 leaves the factory without firmware and ships with blank backup cards. A COLDCARD asks you at first power-up to confirm the number printed on its tamper-evident bag. Any pre-printed words, preinstalled firmware or a bag number that did not match means the device is out.
4. Run the software check, then stop trusting it. Ledger's Genuine Check, Trezor's Device Check, Jade's Genuine Check and BitBox's attestation catch counterfeit chips. A fail retires the device at once. A pass only says you are holding a genuine chip, not an untouched one.
5. Sort each device into one of two piles. Bought direct from the maker, packaging intact, nothing preconfigured: keep. Anything else: retire. Ledger's advice to CryptoBilis buyers is the template. Do not set up an unused device. Move funds off a used one ‘promptly to a new signer with a new recovery phrase.’
Do not take a screwdriver to a suspect device to settle the question. The Ledger guide warns that inspection can damage hardware, and a device you would have to open to trust has already failed the test.
The cost of buying direct
Buying from the maker solves provenance and creates a new record: your name, your street and the fact that you own a signer, all held in a vendor's order system. As last week's feature showed, shipping and customer records leak. The answer is to keep the direct purchase but decouple it from your front door. Use a parcel locker, a mail drop or a work address. Pay with an email alias reserved for hardware. Then order one device per vendor rather than stockpiling spares through a gray-market discount. A marketplace discount buys you nothing except a box with an unknown history.
Marta's bargain signer
Marta bought her signer last year from a marketplace seller at a steep discount. The shrink wrap was intact, the check passed, and she generated her seed on the device. She is careful: the seed lives on steel, and she added a passphrase she types only on the device itself.
If that unit carried an implant like the one Karpelès described, the steel plate does not matter. The board read the words as they appeared on the screen. It read the passphrase as she pressed the buttons. Her hardware is genuine and her coins are exposed. The only fix is to treat everything that ever passed through the device as public, including the passphrase.
Had that signer been one key in a 2-of-3 multisig, the attacker would hold one key out of three and nothing to spend. Replacing one cosigner with a fresh key and a new wallet descriptor takes an afternoon, and no thief is racing you.
Retire and sweep
For each device in the retire pile, work in this order:
1. Buy the replacement direct and run the intake checks above on arrival.
2. Generate a brand-new seed on the new device. Never type the old seed into it. Ledger's own words: ‘Do not enter or restore any recovery phrase on a signer bought from CryptoBilis.’ A restored seed brings its exposure with it.
3. Verify the first receive address on the new device's screen, not just in your desktop wallet, then send a small test amount and confirm it lands.
4. Sweep the rest in batches that mirror how the coins arrived. Panic consolidation glues years of separate history into one transaction for any chain analyst to read.
5. For multisig, replace the cosigner, build a new wallet with the new key, back up the new descriptor and move funds into it.
6. Wipe the old device and keep it off your desk. It is evidence, not a spare.
Keep one rule of thumb: if you cannot name every pair of hands that touched the box, retire the seed. The check on your screen was never built to answer that question, and the vendor says so in writing.
Final thoughts
The CryptoBilis implant left the cryptography intact and beat the assumption that a genuine chip means an honest device. Ledger, BitBox and Coinkite now say, in their own documentation, that a passed check cannot prove an untouched device. That leaves provenance as the buyer's job, and no software update will ever do it for you. Self-custody starts when you open the box, before you write down a single word. Trust the chip, verify the hands.
