Reports about wallet-draining by Ledger users. Total losses $86M+

[Darker45]

Ledger also has resellers who, due to regional proximity, could also pose a threat due to potentially altered technical design.

Unfortunately, there is information that this incident has spread beyond Asia. Now Europe and South America too.

Last I checked, there was somebody from Germany, if I'm not mistaken, who physically bought his tampered Ledger device from the Mediamarkt store, an authorized Ledger retailer in certain European countries.


https://x.com/0xJohannes_/status/2109240472933671125

This was confirmed by Mark Karpelès.


https://x.com/MagicalTux/status/2109249759508869184

However, Ledger has made a comment on the original tweet, directing the user to "refer to the latest update". Ledger's latest update limits "all confirmed cases related to the disclosed draining incident of Oct 9th, 2026, involve devices sold through the Southeast Asia reseller CryptoBilis".


https://x.com/Ledger/status/2109351457279336502


It appears Ledger is still in denial that this scandal is much larger than it first seemed. They may be trying to contain a much more serious and larger backlash.

[Richy_T]

So the scenario is not a nonsense

Sorry, no. You can't take a scenario which is nonsense and compare it to different credible scenarios that have some superficial similarities and say that that validates the nonsense scenario.

[mikel_012]

Mark Karpelès published a video showing all known implants on Ledger Nano X as of October 2026

You can use this to verify your Ledger Nano X for any spy implant

VIDEO: Known implants on Ledger Nano X as of October 2026

[The Sceptical Chymist]

In the first place, Ledger is a closed source wallet and people should have stopped using this wallet a long time ago.

Agreed, and that should be the end of the argument right there--and if being closed-source wasn't enough of an impetus for people to ditch their Ledger devices, the big reveal behind the Recover update should have solidified any rational person's decision.

I've learned you've got to maintain a high level of suspicion, bordering on paranoia, when it comes to anything crypto-related.  Obviously there are still a lot of folks who haven't learned that lesson....yet.  I'll be keeping a curious eye focused on this.

[Pmalek]

I opened my 6-year-old Ledger Nano S today following that guy's recent guide. I bought this around 2019~2020 from CryptoBilis.
IDK, it looks clean? The problem is I can't find a genuine image of this type of PCB on the Ledger site; the only version they have on their site is for the Ledger Nano S Plus. If anybody has the same type of Ledger and could provide an image of their PCB, that'll be great to compare with.

They probably removed the support article about the hardware integrity check of the Nano S when they retired the device (idiots). I managed to find an old capture by Wayback Machine from 2020 that shows images of different versions of the PCB. Take a look at it:
https://web.archive.org/web/20200501075121/https://support.ledger.com/hc/en-us/articles/115005321449-How-to-verify-the-security-integrity-of-my-Nano-S-

There is also this old Steemit blog post:
https://steemit.com/ledger/@cryptohblock/how-to-verify-the-security-integrity-of-a-ledger-nano-s-and-how-to-not-ruin-one-in-the-process

[LoyceV]

This is not a true comparison and your claim that the brand is done is false. Ledger has nothing to do with this case

They could have added anti-tamper measures. Instead, I found this card in my Ledger box years ago:

Considering the number of devices involved, I would have expected many alarm bells if the software could detect the tampered hardware. So my guess it it couldn't find it.

When I bought a Trezor, it came with many anti-tamper measures, up to annoying stickers that leave hard to remove sticker residu. But it helps improve the device's security.

[alani123]

Fwiw funds from a ledger theft seem to have ended up in binance, and probably washed and withdrawn by now.

https://thedefiant.io/news/hacks/peckshield-traces-3-89-million-in-ledger-theft-funds-to-binance-deposits

I've keps saying here that exchanges are the most efficient and most liquid laundromat.
Every good criminal probably has a few hundreds of verified accounts sitting dormant and in good standing for each exchange so they can launcer their money instantly and efficiently when the time comes. Binance seems to be a favourite but it's unlikely that other exchanges are out of it.

[Wind_FURY]

Mark Karpeles continues to investigate the case and, in the following tweet, shows how the spy implant was soldered onto the Ledger circuit board and which testpads it was connected to. apparently, there were two different versions...
for anyone who’s into this and 'understands' circuit boards, these images and this tweet are certainly very interesting.

I opened my 6-year-old Ledger Nano S today following that guy's recent guide. I bought this around 2019~2020 from CryptoBilis.
IDK, it looks clean? The problem is I can't find a genuine image of this type of PCB on the Ledger site; the only version they have on their site is for the Ledger Nano S Plus. If anybody has the same type of Ledger and could provide an image of their PCB, that'll be great to compare with.


[EDIT] I asked Mark Karpelès on X and he said everything looks fine.  
https://x.com/Julerz5853/status/2109277306074333587

BTW, it seems someone from Europe also found something hidden in his Ledger device: https://x.com/0xJohannes_/status/2109240472933671125
Purchased a couple of weeks ago from an official reseller in Europe.

The ability to physically open the Ledger easily has its pros and cons. It's very good for us PLEBS because we could check if there's an implant. But it's also very bad because it's easier for bad actors to put implants.

I have a Trezor Safe 3  that I couldn't physically open, and THAT makes me paranoid. What if bad actors with special tools could open it?

Maybe it was glued shut by a tamper.

  

That "tamper" worked very hard on that one Trezor Safe 3 that was delivered to me?

I own trezor 1 these are old really old maybe 2016 direct from trezor I trust these.
I own trezor 3 this has solana staked I kind of trust it.
I own trezor 5 btc only I no longer trust this one.

My funds are in a core wallet
My funds are in trezor 1
My small funds are in the trezor 3 and 5

  👍

I have the same set up as yours, but I don't own a Trezor Safe 5. I probably should buy one as well, and buy it direct from Trezor as well.

I leave smaller money in the trezor 5 and 3 as canaries to detect theft.

I'm currently doing that too for my Trezor Safe 3. I still DON'T trust it! Although, no hacker/bad actor has implanted a Trezor hardware wallet yet.

[promise444c5]

BTW, it seems someone from Europe also found something hidden in his Ledger device: https://x.com/0xJohannes_/status/2109240472933671125
Purchased a couple of weeks ago from an official reseller in Europe.

Well I found this one Interesting..

Followed the link and eventually ended up reading through a lot of comments .
The owner got the device from mediamarkt and AFAIK, that store is an official reseller in Austria,Germany,Italy and Spain. Apparently, it seems the owner got it from a physical sore.





Obviously, no one should listen to the bs from ledger support that this is only affecting Cryptobilis /SouthAsia . Check your ledger devices no matter where you got them to be sure you’re not affected.. Or better, move your funds till the air clears up.

[LoyceV]

Followed the link and eventually ended up reading through a lot of comments .
The owner got the device from mediamarkt and AFAIK, that store is an official reseller in Austria,Germany,Italy and Spain. Apparently, it seems the owner got it from a physical sore.

It looks plausible to buy a device, compromise it, and return it to the shop for a refund.

[julerz12]

I was thinking, what if they fix the weight of the hardware wallet? Like, the X model will weigh X grams, and they leave no room for removing anything.
~snip~
Also, they can make their devices visible, so we can look directly through a transparent body, or make a layout verification system so easy for new buyers that they can open and close the hardware wallet and confirm within minutes whether it has been tampered with or not.

I think a list of each device's total weight is already on the Ledger website (here), Trezor has those, too, but listing the weight individually per product (example). Also, just as you said, a lot of users suggested that transparent cases/body should now be mandatory. There's also a suggestion on X to deliver the device unassembled, meaning the user would need to piece it together to be able to use it. Going that route, each part would need to be modular so average users could easily assemble them. Not a bad idea, but the devices would probably come with a higher price tag. Ultimately, I'd wish these manufacturers would build tamper-proof devices, maybe fill the entire empty spaces inside the device with resin? Or is that too much to ask? 

They probably removed the support article about the hardware integrity check of the Nano S when they retired the device (idiots). I managed to find an old capture by Wayback Machine from 2020 that shows images of different versions of the PCB. Take a look at it:
https://web.archive.org/web/20200501075121/https://support.ledger.com/hc/en-us/articles/115005321449-How-to-verify-the-security-integrity-of-my-Nano-S-

Thanks for the archive link. Now I have something to compare with.

[LuckyCrypto777]

I was thinking, what if they fix the weight of the hardware wallet? Like, the X model will weigh X grams, and they leave no room for removing anything.
~snip~
Also, they can make their devices visible, so we can look directly through a transparent body, or make a layout verification system so easy for new buyers that they can open and close the hardware wallet and confirm within minutes whether it has been tampered with or not.

I think a list of each device's total weight is already on the Ledger website (here),

And electronic products have errors in all mass, when I was reading Reddit today, I noticed that when comparing the same models, users were panicking because of the differences in grams. 34, 35, 36... but all this is normal



But the website doesn't mention this. For some reason, they only list the weight, accurate to 0.1.



And this further increases the panic.

Weight checking will never provide protection. An attacker can simply grind down the inner walls of the case, making them thinner. This will provide a ground buffer for their chips.

 

Trezor has those, too, but listing the weight individually per product (example). Also, just as you said, a lot of users suggested that transparent cases/body should now be mandatory. There's also a suggestion on X to deliver the device unassembled, meaning the user would need to piece it together to be able to use it. Going that route, each part would need to be modular so average users could easily assemble them. Not a bad idea, but the devices would probably come with a higher price tag. Ultimately, I'd wish these manufacturers would build tamper-proof devices, maybe fill the entire empty spaces inside the device with resin? Or is that too much to ask?  

They probably removed the support article about the hardware integrity check of the Nano S when they retired the device (idiots). I managed to find an old capture by Wayback Machine from 2020 that shows images of different versions of the PCB. Take a look at it:
https://web.archive.org/web/20200501075121/https://support.ledger.com/hc/en-us/articles/115005321449-How-to-verify-the-security-integrity-of-my-Nano-S-

Thanks for the archive link. Now I have something to compare with.

Disassembling the case isn't a great idea, as many users will go to the manufacturer where the hardware wallet is assembled. Few people want to play the "build your own wallet" game.