Reports about wallet-draining by Ledger users. Total losses $86M+

[Darker45]

Ledger also has resellers who, due to regional proximity, could also pose a threat due to potentially altered technical design.

Unfortunately, there is information that this incident has spread beyond Asia. Now Europe and South America too.

Last I checked, there was somebody from Germany, if I'm not mistaken, who physically bought his tampered Ledger device from the Mediamarkt store, an authorized Ledger retailer in certain European countries.


https://x.com/0xJohannes_/status/2109240472933671125

This was confirmed by Mark Karpelès.


https://x.com/MagicalTux/status/2109249759508869184

However, Ledger has made a comment on the original tweet, directing the user to "refer to the latest update". Ledger's latest update limits "all confirmed cases related to the disclosed draining incident of Oct 9th, 2026, involve devices sold through the Southeast Asia reseller CryptoBilis".


https://x.com/Ledger/status/2109351457279336502


It appears Ledger is still in denial that this scandal is much larger than it first seemed. They may be trying to contain a much more serious and larger backlash.

[Richy_T]

So the scenario is not a nonsense

Sorry, no. You can't take a scenario which is nonsense and compare it to different credible scenarios that have some superficial similarities and say that that validates the nonsense scenario.

[mikel_012]

Mark Karpelès published a video showing all known implants on Ledger Nano X as of October 2026

You can use this to verify your Ledger Nano X for any spy implant

VIDEO: Known implants on Ledger Nano X as of October 2026

[The Sceptical Chymist]

In the first place, Ledger is a closed source wallet and people should have stopped using this wallet a long time ago.

Agreed, and that should be the end of the argument right there--and if being closed-source wasn't enough of an impetus for people to ditch their Ledger devices, the big reveal behind the Recover update should have solidified any rational person's decision.

I've learned you've got to maintain a high level of suspicion, bordering on paranoia, when it comes to anything crypto-related.  Obviously there are still a lot of folks who haven't learned that lesson....yet.  I'll be keeping a curious eye focused on this.

[Pmalek]

I opened my 6-year-old Ledger Nano S today following that guy's recent guide. I bought this around 2019~2020 from CryptoBilis.
IDK, it looks clean? The problem is I can't find a genuine image of this type of PCB on the Ledger site; the only version they have on their site is for the Ledger Nano S Plus. If anybody has the same type of Ledger and could provide an image of their PCB, that'll be great to compare with.

They probably removed the support article about the hardware integrity check of the Nano S when they retired the device (idiots). I managed to find an old capture by Wayback Machine from 2020 that shows images of different versions of the PCB. Take a look at it:
https://web.archive.org/web/20200501075121/https://support.ledger.com/hc/en-us/articles/115005321449-How-to-verify-the-security-integrity-of-my-Nano-S-

There is also this old Steemit blog post:
https://steemit.com/ledger/@cryptohblock/how-to-verify-the-security-integrity-of-a-ledger-nano-s-and-how-to-not-ruin-one-in-the-process

[LoyceV]

This is not a true comparison and your claim that the brand is done is false. Ledger has nothing to do with this case

They could have added anti-tamper measures. Instead, I found this card in my Ledger box years ago:

Considering the number of devices involved, I would have expected many alarm bells if the software could detect the tampered hardware. So my guess it it couldn't find it.

When I bought a Trezor, it came with many anti-tamper measures, up to annoying stickers that leave hard to remove sticker residu. But it helps improve the device's security.

[alani123]

Fwiw funds from a ledger theft seem to have ended up in binance, and probably washed and withdrawn by now.

https://thedefiant.io/news/hacks/peckshield-traces-3-89-million-in-ledger-theft-funds-to-binance-deposits

I've keps saying here that exchanges are the most efficient and most liquid laundromat.
Every good criminal probably has a few hundreds of verified accounts sitting dormant and in good standing for each exchange so they can launcer their money instantly and efficiently when the time comes. Binance seems to be a favourite but it's unlikely that other exchanges are out of it.

[Wind_FURY]

Mark Karpeles continues to investigate the case and, in the following tweet, shows how the spy implant was soldered onto the Ledger circuit board and which testpads it was connected to. apparently, there were two different versions...
for anyone who’s into this and 'understands' circuit boards, these images and this tweet are certainly very interesting.

I opened my 6-year-old Ledger Nano S today following that guy's recent guide. I bought this around 2019~2020 from CryptoBilis.
IDK, it looks clean? The problem is I can't find a genuine image of this type of PCB on the Ledger site; the only version they have on their site is for the Ledger Nano S Plus. If anybody has the same type of Ledger and could provide an image of their PCB, that'll be great to compare with.


[EDIT] I asked Mark Karpelès on X and he said everything looks fine.  
https://x.com/Julerz5853/status/2109277306074333587

BTW, it seems someone from Europe also found something hidden in his Ledger device: https://x.com/0xJohannes_/status/2109240472933671125
Purchased a couple of weeks ago from an official reseller in Europe.

The ability to physically open the Ledger easily has its pros and cons. It's very good for us PLEBS because we could check if there's an implant. But it's also very bad because it's easier for bad actors to put implants.

I have a Trezor Safe 3  that I couldn't physically open, and THAT makes me paranoid. What if bad actors with special tools could open it?

Maybe it was glued shut by a tamper.

  

That "tamper" worked very hard on that one Trezor Safe 3 that was delivered to me?

I own trezor 1 these are old really old maybe 2016 direct from trezor I trust these.
I own trezor 3 this has solana staked I kind of trust it.
I own trezor 5 btc only I no longer trust this one.

My funds are in a core wallet
My funds are in trezor 1
My small funds are in the trezor 3 and 5

  👍

I have the same set up as yours, but I don't own a Trezor Safe 5. I probably should buy one as well, and buy it direct from Trezor as well.

I leave smaller money in the trezor 5 and 3 as canaries to detect theft.

I'm currently doing that too for my Trezor Safe 3. I still DON'T trust it! Although, no hacker/bad actor has implanted a Trezor hardware wallet yet.

[promise444c5]

BTW, it seems someone from Europe also found something hidden in his Ledger device: https://x.com/0xJohannes_/status/2109240472933671125
Purchased a couple of weeks ago from an official reseller in Europe.

Well I found this one Interesting..

Followed the link and eventually ended up reading through a lot of comments .
The owner got the device from mediamarkt and AFAIK, that store is an official reseller in Austria,Germany,Italy and Spain. Apparently, it seems the owner got it from a physical sore.





Obviously, no one should listen to the bs from ledger support that this is only affecting Cryptobilis /SouthAsia . Check your ledger devices no matter where you got them to be sure you’re not affected.. Or better, move your funds till the air clears up.

[LoyceV]

Followed the link and eventually ended up reading through a lot of comments .
The owner got the device from mediamarkt and AFAIK, that store is an official reseller in Austria,Germany,Italy and Spain. Apparently, it seems the owner got it from a physical sore.

It looks plausible to buy a device, compromise it, and return it to the shop for a refund.

[julerz12]

I was thinking, what if they fix the weight of the hardware wallet? Like, the X model will weigh X grams, and they leave no room for removing anything.
~snip~
Also, they can make their devices visible, so we can look directly through a transparent body, or make a layout verification system so easy for new buyers that they can open and close the hardware wallet and confirm within minutes whether it has been tampered with or not.

I think a list of each device's total weight is already on the Ledger website (here), Trezor has those, too, but listing the weight individually per product (example). Also, just as you said, a lot of users suggested that transparent cases/body should now be mandatory. There's also a suggestion on X to deliver the device unassembled, meaning the user would need to piece it together to be able to use it. Going that route, each part would need to be modular so average users could easily assemble them. Not a bad idea, but the devices would probably come with a higher price tag. Ultimately, I'd wish these manufacturers would build tamper-proof devices, maybe fill the entire empty spaces inside the device with resin? Or is that too much to ask? 

They probably removed the support article about the hardware integrity check of the Nano S when they retired the device (idiots). I managed to find an old capture by Wayback Machine from 2020 that shows images of different versions of the PCB. Take a look at it:
https://web.archive.org/web/20200501075121/https://support.ledger.com/hc/en-us/articles/115005321449-How-to-verify-the-security-integrity-of-my-Nano-S-

Thanks for the archive link. Now I have something to compare with.

[LuckyCrypto777]

I think a list of each device's total weight is already on the Ledger website (here),

All electronic products have manufacturing tolerances.
When I was reading Reddit today, I noticed that when comparing the same models, users were panicking because of the differences in grams. 34, 35, 36... but all this is normal.



But the website doesn't mention this. For some reason, they only list the weight, accurate to 0.1.



And this further increases the panic.

Weight checking will never provide protection. An attacker can simply grind down the inner walls of the case, making them thinner. This will provide a ground buffer for their chips.

PoW - Proof of Weight  

 

Trezor has those, too, but listing the weight individually per product (example). Also, just as you said, a lot of users suggested that transparent cases/body should now be mandatory. There's also a suggestion on X to deliver the device unassembled, meaning the user would need to piece it together to be able to use it. Going that route, each part would need to be modular so average users could easily assemble them. Not a bad idea, but the devices would probably come with a higher price tag. Ultimately, I'd wish these manufacturers would build tamper-proof devices, maybe fill the entire empty spaces inside the device with resin? Or is that too much to ask?  
Thanks for the archive link. Now I have something to compare with.

Disassembling the case isn't a great idea, as many users will go to the manufacturer where the hardware wallet is assembled. Few people want to play the "build your own wallet" game.

But the idea of pouring it sounds good. The compound would turn the wallet into a monolith.

[Lucius]

~snip~
It appears Ledger is still in denial that this scandal is much larger than it first seemed. They may be trying to contain a much more serious and larger backlash.

This is their way of minimizing every scandal they have faced during the past 6 years. You need to watch the interview with their CEO (Lord of the Rings) to understand how that company reacts to the leak of hundreds of thousands of data of their customers to understand how much they actually care about the end user.


Has anyone thought to investigate the possibility that one of the Ledger employees modified the devices before shipping? Given that it is clearly not just one reseller, this possibility is something that needs to be taken into account.

Agreed, and that should be the end of the argument right there--and if being closed-source wasn't enough of an impetus for people to ditch their Ledger devices, the big reveal behind the Recover update should have solidified any rational person's decision.

I've learned you've got to maintain a high level of suspicion, bordering on paranoia, when it comes to anything crypto-related.  Obviously there are still a lot of folks who haven't learned that lesson....yet.  I'll be keeping a curious eye focused on this.

Everything you say is logical, but apparently very few people in the cryptocurrency world think for themselves, they listen to various "influencers" who fill their heads with nonsense. After everything that happened, the famous criminal CZ declared that Ledger is  one of the most secure hardware wallets that exist...

[LoyceV]

All electronic products have manufacturing tolerances.
When I was reading Reddit today, I noticed that when comparing the same models, users were panicking because of the differences in grams. 34, 35, 36... but all this is normal.

Isn't that the inaccuracy of the scales used? My kitchen scale can't accurately measure the difference between 34 and 36 grams.

[LuckyCrypto777]

All electronic products have manufacturing tolerances.
When I was reading Reddit today, I noticed that when comparing the same models, users were panicking because of the differences in grams. 34, 35, 36... but all this is normal.

Isn't that the inaccuracy of the scales used? My kitchen scale can't accurately measure the difference between 34 and 36 grams.

Yes, kitchen scales have an accuracy of +/- 1 gram. But at the same time, wallet manufacturing will also have an tolerance of 0.5-1 gram.  
For example, a guy posted a Nano S, which is stated on the website as 21 grams:



This means that the weighing method isn't very suitable for kitchen scales.
Because the marginal values, taking into account all the accuracy, for example, for the Nano X are:
34-1-1 = 32
while on other kitchen scales, another Nano X would be
34+1+1 = 36  ...I think it can be even 37.

And in general, the weighing method is bad, it’s better to try to disassemble the device.

On-chain analysts are tracking the path of stolen funds:


https://x.com/AMLBotHQ/status/2109647425971560574

[NABiT]

I own trezor 1 these are old really old maybe 2016 direct from trezor I trust these.
I own trezor 3 this has solana staked I kind of trust it.
I own trezor 5 btc only I no longer trust this one.

My funds are in a core wallet
My funds are in trezor 1
My small funds are in the trezor 3 and 5

And some in kraken and robinhood

I leave smaller money in the trezor 5 and 3 as canaries to detect theft.

Interesting, I have Trezors 1, 3 and 5 and also a Safe 7, the One and the Safe 3 with the same seed having been used for some time with fairly modest amounts, I am planning to test out the Safe 5 and Safe 7 with new seeds, slowly loading up to similar amounts for eventual use as main wallets but your comment made me start thinking that as reports of this type of tampering (only with Ledgers AFAIK) have been trickling in for a while leading up to this case, older is safer for now.

[Wind_FURY]

All electronic products have manufacturing tolerances.

When I was reading Reddit today, I noticed that when comparing the same models, users were panicking because of the differences in grams. 34, 35, 36... but all this is normal.

Isn't that the inaccuracy of the scales used? My kitchen scale can't accurately measure the difference between 34 and 36 grams.

It's them VERY IMPORTANT to find an accurate scale. I'll probably go to a candy shop nearby, where they weigh the candies. I will bring my Ledger, and Trezor Safe 3.

My Ledger is clean/no implants/not tampered. If it's heavier or lighter on the candy store's scale, then adjust the Trezor's expected weight by how much heavier or lighter the Ledger was on that scake.

   ¯\_(ツ)_/¯

[LuckyCrypto777]

It's them VERY IMPORTANT to find an accurate scale. I'll probably go to a candy shop nearby, where they weigh the candies. I will bring my Ledger, and Trezor Safe 3.

My Ledger is clean/no implants/not tampered. If it's heavier or lighter on the candy store's scale, then adjust the Trezor's expected weight by how much heavier or lighter the Ledger was on that scake.

   ¯\_(ツ)_/¯

Store scales aren't known for their accuracy. If you want a more or less accurate result, it's best to go to the pharmacy, as their scales are more accurate than kitchen and store scales.

[Sticky Bomb]

I found this overview of where all funds sits, both those that have been frozen and those that could still be frozen

https://x.com/YFarmX/status/2108918568024760541

As well as a detailed explanation of how the funds are moved to their current destinations
https://x.com/YFarmX/status/2108918564015006200
https://yfarmx.com/ledger-reseller-cryptobilis-drain/

[Swordsoffreedom]

So the scenario is not a nonsense

Sorry, no. You can't take a scenario which is nonsense and compare it to different credible scenarios that have some superficial similarities and say that that validates the nonsense scenario.

I agree that any theory cannot be accepted as true simply because some similarity are found. Rather than dismissing this scenario outright we need to determine which of its assumption cannot be justified. This incident shows that risk of supply chain tampering and hidden hardware implant should be taken seriously. Ledger itself has confirmed that at least one affected device has an implant. However conclusion that all reseller, all device or entire Ledger ecosystem is compromised does not come from there.

I think we need to evaluate each claim individually and determine whether available evidence actually supports it. Any credible incident does not prove any other theory by itself. But that certainly give new weight to question of whether similar attack vector is actually possible.