Reports about wallet-draining by Ledger users. Total losses $86M+

[LoyceV]

Yes, it's technically similar to recursion.

I Googled it. Lol. It got me.

🔹 The Trigger: Antennas embedded in malicious implants act like mirrors—they absorb and reflect these specific RF signals back to the detector.

Until the attackers come up with something new again....

[jahead]

The "Reverse Engineering of the Ledger Nano X board" project by Mark Karpelès (the guy who was the first to warn about the implants) seems a bit super nerdy and maybe even cooler the more you look at it and understand the background - no, I don't... He "decoded" the mainboard of the Ledger Nano X and created an interactive photo (with mouse-over) as well as a 3D visualization (looks like AI was used). This helps people who understand it to see how the Ledger is built, which traces are used for what, and how to spot potential tampering on their own Ledger:

https://karpeleslab.github.io/ledger_nano_x_pads/

Screenshots of the visualizations:

Photo with interactive traces - here


3D visualization - here

The implants were also visualized, with individual components named and added to the graphics:

[Wind_FURY]

Mark Karpeles is developing a low-cost device that can detect spy devices in Ledgers without opening the physical wallet:

Detecting a spy implant without cracking your device open is possible. I'm working on a device to make it cheap and easy, and will publish the PCB and specs so anyone will be able to build it.

https://x.com/BitcoinNewsCom/status/2111822808825127081

This is getting ridiculous. Bitcoin Core can easily check if your Bitcoins are really Bitcoins, by veryfing all blocks on the longest chain. Getting dedicated hardware to store your Bitcoin, and other dedicated hardware to verify the integrity of your hardware somehow reminds me of gold bar testers. What if there's a spy implant in your spy implant tester?

?

Nitpicky today are we?

It's merely a device that could help people check if their devices are tampered or not. In that context, why bring up Bitcoin Core at all?

   ¯\_(ツ)_/¯

[LoyceV]

Nitpicky today are we?

I don't mean to nitpick, but you mean yesterday

It's merely a device that could help people check if their devices are tampered or not. In that context, why bring up Bitcoin Core at all?

I can't help but feel that needing hardware to verify hardware makes it more appealing to go back to basics: verifying your own blockchain and using your own cold storage.

[Sticky Bomb]

The laundering of the proceeds from ledger drain and that of drift protocol takes the same pattern, is this a mere coincidence? The funds moved today after months of staying idle straight into tornado cash.

The thief behind the Ledger reseller customer drain and the holder of the Drift Protocol exploit funds are using the same laundering machine. Today it ran in the open.

https://x.com/YFarmX/status/2112597231647735996

Visuals

[dkbit98]

https://karpeleslab.github.io/ledger_nano_x_pads/

It's funny to see this page is now not accessible anymore.
I don't know if ledger requested this or Mark close it down himself, but my bet is on ledger reported it.
Mark is also working on opensource firmware for coldcrap hardware wallet, so he is really busy after his exchange collapsed.

[vapourminer]

https://karpeleslab.github.io/ledger_nano_x_pads/

It's funny to see this page is now not accessible anymore.
I don't know if ledger requested this or Mark close it down himself, but my bet is on ledger reported it.

works here

it has a photo version that can highlight traces and a rotatable 3d version of the board

perhaps you caught it during an update

[LuckyCrypto777]

The thief behind the Ledger reseller customer drain and the holder of the Drift Protocol exploit funds are using the same laundering machine. Today it ran in the open.

The name Tornado Cash has been popping up so often:
Drift, BitMart, Ronin, Nomad...

works here

it has a photo version that can highlight traces and a rotatable 3d version of the board
perhaps you caught it during an update

Yes, the link is working and the site interface opens.



Scammers can't seem to stop sending emails with links. Recently, there was news about emails asking to "update wallet software," now they're calling it some kind of "synchronization."

[greysonz]

Following a onchain analytics Ledger Reseller Theft move funds: 70,5 BTC

Sender's address: bc1qjqgwejnp8dc0x2938x9n9954hj97t82unx49dl.
However, the final recipient of the funds is currently unknown.


https://x.com/glxyresearch/status/2115165530696880394?a=hxsMXiWJZsblmqNag30&s=19

[PrivacyG]

I can't help but feel that needing hardware to verify hardware makes it more appealing to go back to basics: verifying your own blockchain and using your own cold storage.

But it is more appealing.  You do not rely on storage space for 'Applications', on new updates and whether they will include a way to extract the Seed over the Internet, on proprietary software and hardware particularly designed for a Bitcoin Wallet et cetera.

It is only less comfortable and makes you look basic.  I suppose many prefer to simply be less basic?

[Pmalek]

Update from Trezor dated October 30, 2026, it looks like the same reseller, CryptoBilis, may have also sold a tampered Trezor Safe 5 hardware wallet.

There is already a separate thread with discussions about the modified Trezor Safe 5 in this subforum. You should check Hardware Implants found in Trezor safe 5. It's best to keep discussions about the Trezor in that topic and talk about Ledger here unless the discussion is somehow connected and includes both products. Talking about the same things in two different things can result in people sharing the same information multiple times.