Jon Tetreault

Writing · October 2026

The check passed.

A hardware wallet can pass its maker's own authenticity test and still carry a second board that watches your screen. That is what's being reported this week about devices sold through one reseller.

On October 9, Help Net Security reports, customers in Southeast Asia began saying their wallets had been drained. By October 10, per BleepingComputer, Ledger confirmed that "one of the impacted users' devices contained an unauthorized hardware implant." I'm not writing about one company. I'm writing about the failure: a device can be genuine where it counts and compromised where you can't see.

What the reporting says

Ledger says all confirmed cases involve devices sold through a Southeast Asia reseller, CryptoBilis, and that its own systems and direct sales were not compromised. Help Net quotes Ledger's October 11 update on X calling the damage limited. Help Net says CryptoBilis has stopped selling hardware wallets. BleepingComputer says Ledger asked it to stop.

The implant comes from researchers, not Ledger, which has not explained how it works. BleepingComputer, citing Tibane Labs and Mark Karpelès, describes a small board with a microcontroller, an eSIM and a shielded LTE module, tucked behind the screen. Karpelès says it reads the display and button presses to catch the seed phrase and sends it out over LTE. BleepingComputer says Tibane Labs independently confirmed his findings and found two versions. Researchers say they have seen it since September 16, and that tampered units were offered at nearly half price.

Why the check passed: the original security chip was still inside. Ledger's Genuine Check can't detect an added implant when that chip is intact, BleepingComputer reports. Help Net says Karpelès's device passed it.

Where the reporting thins out

The money. Help Net says on-chain researchers at Bitquery put suspected losses above $93 million. BleepingComputer gives no total and lists the amount stolen and the number of victims as unverified. Ledger itself says limited. I'd treat $93 million as one firm's estimate, not a confirmed figure.

The link. Karpelès did not name CryptoBilis, BleepingComputer says. He said he bought through "a well known platform via a Chinese seller (product shipped from Malaysia)." So his teardown and the reseller Ledger named haven't been tied together in anything I read. How and when the devices were tampered with, and by whom, is also open. Help Net notes an unverified claim that devices sold in Europe may be affected too. Ledger hasn't commented on it. BleepingComputer says there's no sign of other resellers so far.

A genuine chip doesn't make a genuine device

The test asks whether the safe is real. It doesn't ask who opened the box before it got to you. The implant doesn't need to break the chip. It only needs to be there at the moment the screen shows your recovery phrase. After that, per Help Net, the attacker rebuilds your wallet elsewhere and never touches your device.

A carpenter knows this one. A stamped square is only as true as the hands it passed through before you. You can check the stamp all day. The only real check is where you got it.

This is a different failure from the Coldcard bug in August, where weak keys were the problem. Here, the keys can be perfectly good and still get copied as they're shown.

What I'd do

  1. Buy from the maker, or a reseller the maker lists on its own site. Ledger is urging buyers to use authorized channels only, per BleepingComputer. A price near half is a stop sign, not a bargain.
  2. Don't use a device that arrived opened, returned, or used. Ledger is asking authorized resellers not to restock returns.
  3. Don't count on inspecting it yourself. Karpelès says opening the device is the only reliable way to find the board, per Help Net. If your source was a third party, replace the device rather than trust a check.
  4. If you bought from CryptoBilis or any unauthorized seller: Ledger's guidance, as both outlets relay it, is not to set the device up. If you already did, move assets to a new device with a new seed. Send a small test amount first.
  5. Get guidance only from the vendor's page you bookmarked on a calm day. Help Net says Ledger will never call, message, or ask for a 24-word phrase. Incidents like this are when fake "support" shows up.

The boring conclusion

The check passed, and the phrase still leaked. The step that mattered happened before you ever opened the box. Ask where your hardware came from while nothing is wrong.

Verify everything, including where your device came from.

— Jon Tetreault, October 2026. The habits, tools, and checks behind this piece are what I teach in Crypto Security Mastery.