Who Is Planting Backdoors in Ledger Crypto Wallets?

The theft last week of an estimated $100 million in crypto using a hardware backdoor planted in Ledger wallets points to a sophisticated and systematic attack aimed at subverting crypto wallets sold by legitimate resellers in Asia and Europe

Kim Zetter

Oct 13, 2026 • 14 min read

comment-1 Created with Sketch Beta.

A Ledger Nano X showing an implant (below right) discovered in the device. (Image: Courtesy of Joe Grand)

After crypto wallet maker Ledger announced Friday that a backdoor embedded in a handful of Ledger wallets sold in SouthEast Asia allowed thieves to hijack around $102 million in crypto from their owners, news has emerged of other Ledger wallets sold in Germany also having implants.

The hardware implants were originally found on an unknown number of Ledger Nano X wallets sold by an authorized Ledger reseller called CryptoBilis based in Malaysia. Ledger said the implants were found on a limited number of devices, all sold by the same seller. But a Ledger device owner in Europe has since said that he found an implant on a Nano X that he purchased at a large European electronics chain store in August and a second one he purchased this weekend at another store in the same chain. He believes these indicate that Ledger’s supply-chain has been compromised.

Since then, users and researchers have also reported finding implants in Ledger Flex and Ledger Stax devices – two of Ledger's more recent line of devices used for securely storing keys used to access a device owner's crypto accounts.

The implants are not the first to be found on Ledger wallets. Famed hardware hacker Joe Grand found implants on several Nano X wallets earlier this year and notified Ledger about them in March, raising questions about Ledger's urgency in addressing the issue. Many of the implants discovered more recently appear to be more sophisticated iterations of the ones that Grand found.

The implants Grand discovered were also all in wallets sold by unauthorized online sellers who seemingly ran fly-by-night operations that weren’t in business for long. But the implants found in wallets sold by CryptoBilis and the European electronics chain indicate the attackers have switched tactics and may be deliberately compromising wallets sold by authorized resellers now. Ledger and its competitor Trezor have cautioned users for years to buy wallets only from their web sites or from authorized resellers. But the recent compromises indicate that attackers are deliberately targeting authorized sellers to exploit customer trust in them and to get wider distribution for implanted devices. What’s more, the attackers have become more skilled and systematic in their method for compromising the wallets, making it more difficult to detect the implants, Grand and other researchers say.

It's not clear how long the implants have been sitting in the sold devices, but last week a coordinated heist resulted in millions of dollars in crypto being stolen from the device and accountholders. According to blockchain research company Bitquery, crypto was stolen from about 315 accounts connected to compromised CryptoBilis Ledger devices alone, and is currently valued at around $102 million. The stolen funds include Bitcoin, Ethereum and Tron and other cryptocurrencies. Some of the funds have reportedly been frozen in the accounts to which the thieves transferred it, and other funds appear to be in accounts that have been flagged for fraud. And it's not clear if funds were also stolen from Ledger owners who purchased their devices from other sellers.

Ledger, based in France, wrote in statement posted to X that it had asked CryptoBilis to halt all sales and shipments of Ledger devices until it could conduct an investigation. CryptoBilis — which is authorized to sell Ledger wallets in Malaysia, Indonesia and the Philippines — wrote on its web site that it is cooperating with Ledger’s investigation.

But a user going by the name Johannes wrote on X over the weekend that he had purchased a Ledger Nano X wallet in person from a MediaMarkt store that had an implant. MediaMarkt is Germany’s equivalent to BestBuy and has 1,000 stores in ten European countries. It’s listed as an authorized reseller of Ledger wallets in Austria, Germany, Spain and Turkey.

Johannes told Zero Day he purchased the wallet in August in a MediaMarkt store in Germany but only took the device apart this weekend following reports that implants had been found. He posted photos of an antenna and implant in his device. Johannes said that he has had no crypto stolen.

In an update to X this weekend, Ledger suggested the implant problem may stem from authorized resellers obtaining Ledger wallets from illegitimate sources or reselling wallets that were bought and returned to them — after being compromised.

“We are reminding our authorized resellers and distributors to source products only through authorized channels and never to restock returned products,” Ledger wrote. “This is an ongoing threat that doesn’t just impact Ledger, but the whole ecosystem, and we are calling others in the space to work with us on making improvements for users…. Raising the bar on physical supply-chain integrity benefits the entire ecosystem.”

But Johannes, who purchased a second Ledger wallet from another MediaMarkt store on Monday and found an implant in it as well thinks this suggests that Ledger’s supply chain has been compromised.

“This indicates a widespread issue rather than an isolated incident, potentially affecting Ledger inventory across MediaMarkt and Saturn stores throughout Europe,” he wrote on X. He says he initially thought his two compromised devices might have been return items that the store then resold as new, but a MediaMarkt employee told him they were new devices and that returns are sent back to Ledger, not re-sold.

Ledger did not respond to an inquiry from Zero Day, but the company wrote on X that there is currently "no indication that Ledger's security infrastructure, systems or services have been compromised.

The issue raises questions about Ledger’s response to the implants and its transparency to customers. After Grand notified the company last March about implants he found in Ledger wallets, the company told him it would investigate to determine who was behind the implants. But Grand says he never received any followup until months later when he asked about it, and someone at Ledger told him they had found no evidence that someone had used the implants to steal crypto from device owners.

But the situation began to change after this.

If you find this article valuable, you can leave a one-time tip to express appreciation to the author.

In April and May, Grand published his implant findings online and gave two presentations about them at conferences in April and May. Mark Karpelès, a French businessman and former CEO of the infamous bitcoin exchange Mt. Gox who was charged with fraud following the collapse of his business, saw Grand's research online and decided to purchase Ledger wallets to see if he could find implants in them as well. He obtained two wallets and found more advanced iterations of the implant Grand discovered and published his findings online last month.

Karpelès's notoriety in the crypto world caused information about the implants to spread widely in the crypto community, which may be why the heists occurred last week. The attackers may have been waiting until they had amassed many wallets with large balances associated with them before pulling off a widespread heist of funds. But once news about the implants began to spread, this may have spurred the thieves to quickly grab as much crypto as they could from wallets already compromised, before wallet owners could move to protect those funds. Some people online have been praising Karpelès for exposing the implants and an operation that might have gone unnoticed for years until he wrote about it.

Grand began looking at Ledger wallets in August 2025 after someone published a Reddit post indicating he had found something in his Ledger Nano X wallet. The owner, who purchased the wallet from an online marketplace in Thailand, cracked opened the wallet’s casing and found extra circuitry that should not have been there. He sent the wallet to Grand to see if he could confirm it was a backdoor and determine what it was designed to do.

Inside the device, Grand found an extra board as well as an antenna, LTE module and eSIM. He determined that the implant was stealing the recovery seeds of infected wallets and transmitting them to the attackers. The implant would sit silently on the device until the owner initialized it and caused it to generate a random seed phrase – essentially a password stored on the Ledger device to allow the device holder to access their crypto account. As the device sent each character of the seed phrase to the device's small screen to display to the owner, the implant copied them and stored the data before subsequently using the LTE module, antenna and eSIM to connect to a nearby cell tower and transmit the seed to the hackers.

Grand, who runs Grand Idea Studio, was thrilled with the finding because although there have long been rumors and theoretical claims about hardware implants on wallets he had never seen one in the wild. He purchased eight more Ledger wallets from several online sellers in Thailand and found that four of them were compromised with similar implants. All of the ones Grand purchased came from "sketchy" sellers on Lazada, an e-commerce platform in SouthEast Asia that is a subsidiary of the Chinese company Alibaba Group. The devices were shipped from Thailand.

On March 4, Grand reported his findings to Ledger and had a Zoom call with a team there, and subsequently gave two talks about the backdoors at the Tropicon conference in April and at the Hardwear.IO conference in May and posted his slides online. He also continued to have some e-mail conversations with Ledger before moving to a Signal group chat with some technical staff there as well as with a researcher based in Japan who had purchased some wallets through online sellers there in March and found implants in them.

Video of Joe Grand's presentation about the Ledger implants given earlier this year at Tropicon.

In September, Karpelès saw Grand’s research and obtained two Ledger wallets, including one purchased at half price from a Chinese seller on Amazon that arrived in a “flawless” shrink-wrapped box from Malaysia. He found implants inside both wallets and published his findings last month on the web site for Tibane Labs, which Karpelès owns and uses to conduct blockchain research and produce open-source tools. The implants operated similar to the ones Grand had found, but they were much more sophisticated in their design and more cleverly hidden to make them harder to spot inside a device.

Karpelès said the version Grand found appeared to be a prototype that had evolved over time. That first-generation involved a bundle of hand-soldered wires that stood out to anyone who opened the devices. The wires connected the implant to the Nano’s screen to grab each character of the randomly-generated seed as they were displayed on the screen.

The more advanced implant used an orange-colored, transparent, custom-built flexible circuit laid over the wallet’s original board and laminated flat onto it and soldered in select places, eliminating the need to solder wires that could be easily seen. To make room for the additional circuit, the hackers had replaced the original battery with a smaller one. Based on some markings, the implant appeared to have been assembled in December 2025 or later.

The second implant, which he found in the device shipped from Malaysia, was the most advanced. Inside the wallet, there appeared to be nothing to distinguish it from an unmodified Nano X device. But a thin black antenna running along the top edge of the board w