Cyber Security / Crypto
The Ledger Implant Attack in Malaysia: What Is Confirmed, What Is Alleged, and What CryptoBilis Buyers Should Do
Ledger confirmed a hidden hardware implant in a device sold through its Malaysian reseller CryptoBilis, after wallets worth an estimated US$72 to 94.5 million were drained on 9 October 2026. What buyers should do now, how the implant works, and which viral claims are confirmed, alleged or unproven.
Akmal Alif · 11 October 2026 MYT
Crypto is a new corner of EXEPERT's Cyber Security section, for the security of digital assets: wallets, keys, scams and the supply chains behind the devices people trust with their savings. It opens with a hardware-wallet attack that hit buyers in Malaysia and the wider region.
On 9 October 2026, starting just after 1pm Malaysia time, hundreds of crypto wallets were drained across half a dozen blockchains. The same day, Ledger, the French maker of the Nano hardware wallets, said it was investigating losses among South East Asian customers who had bought devices from CryptoBilis, an authorised Ledger reseller that sells in Malaysia, the Philippines and Indonesia. A day later Ledger confirmed that one affected user's device contained "an unauthorized hardware implant" (Ledger Support, 2026b).
Messages about the attack spread quickly on WhatsApp and Facebook, mixing confirmed facts with claims nobody has verified. This post separates the two, explains how this kind of implant works, and sets out what buyers should do.
If you bought a Ledger from CryptoBilis
Ledger's own guidance, repeated on 9 and 10 October, is the place to start (Ledger Support, 2026a, 2026b):
Bought in the last 90 days and not set up yet: do not set it up.
Already set up: move your funds to a new wallet with a brand-new recovery phrase. Buy the new device directly from Ledger or a reseller you trust, and generate a fresh phrase on it.
Never reuse the old recovery phrase. If the phrase was shown on a compromised device, assume it is known to the attacker. A new device restored with the old phrase is still exposed.
Keep the old device and its packaging, and file a police report. CryptoBilis's own notice asks victims to keep the hardware, avoid resetting it, and report to the police (CryptoBilis, 2026a).
Talk to Ledger only through its official support site. Ledger will never ask for your 24 words. Incidents like this attract scammers posing as support staff or "recovery" services.
What happened, in order
When (UTC) | What happened |
|---|---|
March 2026 | CryptoBilis changes hands. Its former co-founders say they sold the company and stepped away from operations. |
16 September | Mark Karpelès, the former head of the Mt. Gox exchange, posts photos of a spy implant found inside a Ledger Nano X. |
24 to 25 September | The attacker's collecting addresses receive their first funds, followed by two weeks of small test transactions. |
9 October, 05:07 | The mass drain begins on TRON and spreads within 47 minutes to Ethereum, BNB Chain, Polygon, Solana and Bitcoin. |
9 October, 12:00 to 12:24 | On-chain researchers tanuki42 and Specter publish the drain addresses, with loss estimates above US$72 million and US$86 million. |
9 October, 13:32 (21:32 in Malaysia) | Ledger says it is investigating losses among buyers from CryptoBilis and has asked the reseller to pause sales and shipments. |
9 October, 16:54 | Ledger says it believes the losses are limited to devices sold through CryptoBilis and sees no sign that its own systems were compromised. |
9 to 10 October | CryptoBilis pauses Ledger sales, then all hardware-wallet sales of every brand in Malaysia, the Philippines and Indonesia, and closes its physical stores. |
10 October, 17:09 | Ledger confirms an unauthorised hardware implant in one affected user's device and says it is working with the appropriate authorities. |
11 October | Blockchain analytics firm Bitquery estimates US$93.2 million taken from 315 wallets on six chains. |
Sources: Bitquery (2026); CryptoBilis (2026a, 2026b); Ledger (2026); Ledger Support (2026a, 2026b); Prabu (2026); Tibane Labs (2026).
How this kind of implant works
Ledger has not described the implant it found. But independent researchers had already taken apart implanted Nano X units bought elsewhere, and their findings show how such an attack works (Tibane Labs, 2026; Grand Idea Studio, 2026).
An extra circuit inside the case. A thin flexible board is hidden where the screen's foam padding should be, or in place of part of the battery, and soldered to the device's test pads.
It reads the screen, not the chip. The board taps the data lines that carry pixels to the small display. When the wallet shows the 24-word recovery phrase during setup, the implant's microcontroller recognises the words as they are drawn.
It sends them out over the mobile network. An LTE modem and an embedded SIM card send the captured words to the attacker. No Bluetooth pairing or USB connection is needed, and the owner sees nothing unusual.
The specimens studied by the researcher group Tibane Labs came from Yahoo! Auctions Japan and from a China-based seller on Amazon Japan, with one unit shipped from Malaysia. Tibane Labs says it has not examined a device sold by CryptoBilis (Tibane Labs, 2026). The link between these teardowns and the CryptoBilis losses rests on Ledger's confirmation of an implant in one victim's device and on photos that victims have shared with researchers.
Why the Genuine Check did not catch it
Ledger devices run a "Genuine Check" during setup that proves the secure element, the tamper-resistant chip that holds the keys, is authentic. Ledger's own documentation says the check cannot detect a spying implant if the original secure element is still in place (Ledger, n.d.). This attack never touches the secure element. It waits for the one moment the secret has to leave the chip: when it is shown on the screen for the owner to write down.
Claims check
Much of what is circulating comes from social media, including a widely shared Facebook post by Khairul Anwar Sanusi and a WhatsApp alert. Here is where each claim stands as of 11 October 2026.
Claim | Status | Basis |
|---|---|---|
Ledger is investigating stolen crypto involving CryptoBilis customers | Confirmed | Ledger statements, 9 and 10 October |
A hidden implant was found inside an affected device | Confirmed for one device | Ledger, 10 October |
The implant has an LTE radio and eSIM and captures the recovery phrase from the screen | Documented on implanted units from other sellers; Ledger has not described the CryptoBilis implant | Tibane Labs; Grand Idea Studio |
About US$100 million was stolen | Not confirmed. Independent estimates range from more than US$72 million to US$94.5 million, and Ledger has given no figure | tanuki42; Specter; MistTrack; Bitquery; YFarmX |
All the losses come from CryptoBilis devices | Ledger believes so; not independently established | Ledger, 9 October |
CryptoBilis was sold to new owners | Stated by the former co-founders, who date the sale to March 2026 | Arravind Prabu on X |
The buyer is a Chinese national | Unverified. It rests on a redacted company-registry screenshot posted by a pseudonymous account, with the nationality field blacked out | Posts on X |
The original owners were made to sign a non-disclosure agreement | The former co-founders say a contract barred them from announcing the sale until 19 October; no document is public | Arravind Prabu on X |
The new owners fitted the implants | Unverified. Ledger has not said who fitted the implants or where, and has not accused CryptoBilis | Ledger statements; press reports |
The devices were also sold on Shopee | Unverified. No CryptoBilis store on Shopee was found | Ledger reseller list |
The ownership questions matter, but they are not settled. A change of ownership is not evidence of tampering, and the implants could in principle have entered the supply chain at another point. Until investigators or Ledger say more, the honest summary is that the reseller's ownership changed and its devices were compromised, and nobody has publicly shown how the two connect.
The Facebook post makes three main allegations: that a Chinese national bought a trusted Malaysian Ledger distributor, that the original owner was made to sign a non-disclosure agreement, and that the new owner inserted a hidden board before selling the devices. As the table shows, the first two are only partly supported and the third is unproven.
Who is affected, and how much was taken
Ledger has not published a victim count or a loss figure. The estimates come from on-chain analysts who traced the attacker's addresses:
tanuki42: more than US$72 million across eight addresses, on 9 October.
Specter: more than US$86 million, on 9 October.
MistTrack: approaching US$90 million, on 9 October.
Bitquery: US$93.2 million from 315 wallets on six chains, on 11 October, with about US$10 million in USDT frozen by Tether (Bitquery, 2026).
YFarmX: US$94.5 million from 521 addresses on seven chains, on 11 October (YFarmX, 2026).
Bitquery's reconstruction points to a single actor holding every key: dozens of wallets signed the same transaction within seconds, and 111 Bitcoin wallets were emptied in one block. That pattern fits stolen recovery phrases far better than individual phishing.
In Malaysia, no mainstream outlet had reported the Ledger link by 11 October, and no statement from the police or the Securities Commission about it had been published. A Perak police case involving a RM12.47 million crypto theft on 9 October did not mention any device or reseller, so it cannot be tied to this incident.
Why supply-chain attacks are so hard to defend against
Most crypto security advice assumes the device is honest and the danger is the user: a phishing link, a fake app, a phrase typed into a website. A supply-chain attack breaks that assumption. The device is compromised before it reaches the buyer, often in packaging that looks factory-sealed, and it behaves normally until the attacker decides to strike.
It is also not Ledger's first supply-chain problem. In 2020 an attacker accessed Ledger's e-commerce database, and in December that year a dump of about 272,000 detailed customer records appeared online, followed by waves of phishing (Ledger, 2020). In December 2023, a former employee's account on the npm software registry was phished and used to publish malicious versions of Ledger's Connect Kit library, which drained users of decentralised apps for under two hours (Ledger, 2023). The 2026 case is different in kind: the attack is in the hardware itself.
A few lessons hold regardless of brand:
Shorten the chain. Buy directly from the manufacturer where possible. An "authorised reseller" is a commercial relationship, not a guarantee of who handled each box.
Treat setup as the most sensitive moment. It is when the recovery phrase exists in plain view. Anything that can see the screen at that moment can steal the wallet.
Spread the risk. For large holdings, a multi-signature wallet that needs approval from devices of different makes, bought from different places, means one compromised device is not enough.
Watch for warnings. Researchers had published photos of implanted Nano X units weeks before the drain. Following hardware-security researchers and the manufacturer's official channels can give early notice.
What we still do not know
How many CryptoBilis devices contain implants, and how many buyers are affected.
Where in the supply chain the implants were fitted, and by whom.
Whether the change in CryptoBilis's ownership is connected.
Which authorities Ledger is working with, and whether Malaysian police or regulators have opened an investigation into the reseller.
EXEPERT will update this post as Ledger, CryptoBilis or investigators publish more.
References
Bitquery. (2026, October 11). Ledger CryptoBilis hack investigation. https://bitquery.io/investigations/ledger-cryptobilis-hack
CryptoBilis. (2026a, October 9). Official notice [Post]. X. https://x.com/cryptobilis/status/2108641764605354103
CryptoBilis. (2026b, October 9). Update: Pause of all hardware wallet sales [Post]. X. https://x.com/cryptobilis/status/2108671666490626200
Grand Idea Studio. (2026). Ledger hardware implant. https://grandideastudio.com/portfolio/security/ledger-hardware-implant/
Khairul Anwar Sanusi. (2026, October). Post on the Ledger spy-chip case [Facebook post]. Facebook. https://www.facebook.com/story.php?story_fbid=10163486923024492&id=715489491
Ledger. (n.d.). A closer look into Ledger security: The root of trust. Retrieved October 11, 2026, from https://www.ledger.com/a-closer-look-into-ledger-security-the-root-of-trust
Ledger. (2020, July 29). Addressing the July 2020 e-commerce and marketing data breach. https://www.ledger.com/addressing-the-july-2020-e-commerce-and-marketing-data-breach
Ledger. (2023, December 20). Security incident report. https://www.ledger.com/blog/security-incident-report
Ledger. (2026, October 9). Statement on CryptoBilis-related losses [Post]. X. https://x.com/Ledger/status/2108601890401305087
Ledger Support. (2026a, October 9). Investigating losses among CryptoBilis buyers [Post]. X. https://x.com/Ledger_Support/status/2108551100613714002
Ledger Support. (2026b, October 10). Situation update [Post]. X. https://x.com/Ledger_Support/status/2108968264055345381
Prabu, A. (2026, October 9). Statement on CryptoBilis ownership [Post]. X. https://x.com/PrabuArravind/status/2108579734833738143
Tibane Labs. (2026, October 9). Ledger Nano X implant field report. https://www.tibane.net/research/ledger-nano-x-implant
YFarmX. (2026, October 11). Ledger reseller CryptoBilis drain. https://yfarmx.com/ledger-reseller-cryptobilis-drain/