Some Users Suspected Ledger earlier before the main Incident

[Bitcoin-Forever]

The Singapore police how they report filed concerning two Ledger users whose wallets had been compromised, claiming about 2.7 million dollars asset worth, stating that a malicious hardware component was installed on the hardware wallet through their retail sellers, this was an incident that happened earlier before the major one that claim a larger amount of coins from affected users.

Had it been it was earlier taken serious earlier since September 10 and the information was passed across to all crypto platform before the major incident, maybe the Ledger scenario would have only comprises of the two affected users than the entire massive affected users, before the final burst this October.

Singapore police say at least two cases involving tampered Ledger hardware wallets have been reported since Sept. 10, with combined losses of about 3.5 million Singapore dollars ($2.7 million), placing local reports almost a month before the wider incident became public. https://cointelegraph.com/news/tampered-ledger-wallets-cost-singapore-users-27m-police

[Charles-Tim]

People can not know until the attack has been done. If two people's Ledger hardware wallet were seen to be tampered with, but no other people are affected and no warning from Ledger or a trusted source that there are more Ledger that have been tampered with, no one will be careful of transferring their coins from Ledger to addresses on another wallet. But as many people were affected, that is when the panic will begin.

[ABCbits]

Both the news and Singapore police statement[1] doesn't mention where the victim bought their Ledger device. It makes me wonder if they bought from CryptoBills (reseller in the main incident) or not.

Had it been it was earlier taken serious earlier since September 10 and the information was passed across to all crypto platform before the major incident, maybe the Ledger scenario would have only comprises of the two affected users than the entire massive affected users, before the final burst this October.

Yeah. Even considering time to do the preliminary investigations and whole legal produces on police side, we certainly wish it could happened earlier.

[1] https://www.police.gov.sg/Media-Hub/News/2026/10/20261028_police_advisory_on_tampered_cryptocurrency_hardware_wallets

[Pmalek]

Had it been it was earlier taken serious earlier since September 10 and the information was passed across to all crypto platform before the major incident, maybe the Ledger scenario would have only comprises of the two affected users than the entire massive affected users, before the final burst this October.

The first cases of Ledger hardware wallets with implants in them we are aware of became public at the end of June 2026. Joe Grand talked about them and reverse engineered those early models. Those devices were bought in Thailand and the online marketplace Lazada. Who knows how long they have been around before they were first discovered, though. It could have started with one person or group figuring out how to do this and then others jumped in and it became much more widespread.

Reverse Engineering a Ledger Nano X Hardware Implant

A crypto user from Thailand had a Ledger Nano X hardware wallet, but the internal battery wasn't working properly. He decided to buy another Nano X, the cheapest one he could find, in order to take its battery and replace the one in his device. He bought one from Lazada. Lazada is an official Ledger reseller for Thailand, but it turns out that the service had (maybe it still has) fake listings as well.

When he got his device, he opened it, noticed that the battery was smaller, and that the circuitry and wires looked different from his device. He posted about it on Reddit and went to the police in Thailand, but nothing was done about it. So, he found Joe and sent him the newly bought wallet for inspection.

Here is an image of what the user found after opening the bought and modified Nano X:


Jos also purchased multiple modified Ledger wallets from Lazada to inspect them.

Here is a close-up of one such device:


And a comparison between a legit Nano X at the top and a modified one at the bottom:


This is the back side of the implant:


Joe started taking them apart to figure out how they were working. He noticed there was an antenna, which signals potential wireless capabilities. He found out that the implant sends something over a cellular network. Joe accessed and dumped the flash memory of the microchip on the implant.

He also discovered that the implant had an eSIM on it. Joe extracted the data from the eSIM, hoping to find information about the person/group who created the implant.  He learned that it was a data-only eSIM that was originally registered in the Netherlands through Vodafone.

Here is another picture of the entire implant with information about the individual components:


Through reverse engineering, Joe found out that the implant has a storage area where it stores recovery phrases. The implant monitors the Nano X’s screen. When the user starts configuring their wallet and generates the seed, the implant logs the data, moves it to flash, and sends it over a cellular network to the hacker.

Joe contacted Ledger and informed them about his findings. They exchanged some information and told him they have had a similar experience with such implants in Ledger devices as well. They also told him that their future devices will have better mitigations against such attacks.

[Synchronice]

Malicious hardware components inside Ledger? That's interesting because their own secure chip is malicious too (if you know what I mean). I wonder what should happen next to the Ledger for people to understand that they shouldn't buy this hardware wallet? As it seems, the fact that they lied about Secure Chip, they had data leaks and now their official resellers are selling fake wallets or wallets with malicious hardware components, is not enough to convince people to abandon this company and find a different one or in the best case, use their own air-gapped computer.

@Pmalek
Wonderful post. I didn't know about that accident. That criminal is smart though.

[FinneysTrueVision]

Ledger has a history of downplaying these vulnerabilities and it unfortunately led to where we are. They are the biggest name in hardware wallets and if they had not been so dismissive many people’s funds could have been saved and other wallet manufacturers could have also taken proactive steps to mitigate supply chain risks.

There was plenty of evidence that they were already aware of implants being installed in their wallets, but instead of issuing a recall or taking some action that could have prevented more widespread damage, they chose to lie publicly by saying that tampered hardware wallets would fail a genuine device check.



The arrogance and prioritizing profits over the safety of their customer’s funds is the same kind of attitude that was shown by Coldcard. After these incidents, these companies deserve to go out of business, but users are sometimes stubbornly brand loyal that it allows them to continue operating without much accountability.

[Bitcoin-Forever]

The first cases of Ledger hardware wallets with implants in them we are aware of became public at the end of June 2026.

This is one of the relevance of following up with trends as this information is very important as well as how you were able to reference back the similar warning alerted since June that you posted, which is more earlier to the one I mentioned, thanks for this update.

Everything is showing that Ledger wallet has either a secret motive and probably an insider that work for them and make them continue to operate in this manner or should we call it not being professional attitude to have allowed things like this to prevail without making any move against it, I don't expect they authorize their retailers to this extent and after hearing of what they are doing, yet decided not to take any action, who knows if they are the ones behind the retailers they used in disguise.

[Pmalek]

Everything is showing that Ledger wallet has either a secret motive and probably an insider that work for them and make them continue to operate in this manner or should we call it not being professional attitude to have allowed things like this to prevail without making any move against it, I don't expect they authorize their retailers to this extent and after hearing of what they are doing, yet decided not to take any action, who knows if they are the ones behind the retailers they used in disguise.

There are things out of their control and then there are things they can affect or properly handle when they happen. Counterfeiting and physical manipulation is something that many brands worldwide experience and suffer from. Just look at clothing and fashion brands. Counterfeit products will always exist. If there is money to be made, people will find a way to do it. Similarly, if there is a way to cheat and steal, people will do that too.

These implants are a novelty right now. We haven't seen them before the manipulated Ledgers. Years ago we saw fake Russian Trezor One models but they weren't 1:1 copies of genuine devices and looked different. It's only normal that both Ledger and other companies need to figure out how to fight this.

What Ledger failed to do is to go public with their findings and findings of other people who spoke with them. Tell existing customers and potential ones about these hardware implants and inform them how to check for them and spot them. Instead, we see other people offering solutions and advice. Like that Mt. Gox guy who created a piece of software that scans and looks for hardware implants and signals that shouldn't be in a Ledger hardware wallet. Ledger could have done that, but they didn't. It's easy to see why. It would affect their profits and sales.

[Meuserna]

Everything is showing that Ledger wallet has either a secret motive and probably an insider that work for them and make them continue to operate in this manner or should we call it not being professional attitude to have allowed things like this to prevail without making any move against it, I don't expect they authorize their retailers to this extent and after hearing of what they are doing, yet decided not to take any action, who knows if they are the ones behind the retailers they used in disguise.

There are things out of their control and then there are things they can affect or properly handle when they happen. Counterfeiting and physical manipulation is something that many brands worldwide experience and suffer from.

Counterfeiting will surely be the next wave of commercial hardware wallet robberies because parts are cheap and 3D printing is too, and there's nothing that can be done to stop it. People want easy access and cheaper prices, so they'll buy from sketchy places to save a few bucks. And they'll lose everything.

What Ledger failed to do is to go public with their findings and findings of other people who spoke with them. Tell existing customers and potential ones about these hardware implants and inform them how to check for them and spot them. Instead, we see other people offering solutions and advice. Like that Mt. Gox guy who created a piece of software that scans and looks for hardware implants and signals that shouldn't be in a Ledger hardware wallet. Ledger could have done that, but they didn't. It's easy to see why. It would affect their profits and sales.

Ledger is a terrible company. I'm sure they have some talented devs, but I wish those devs would take their talents elsewhere because they're tarnishing their own reputations by working for such a shady company. I roll my eyes every time I see the name Ledger.

[promise444c5]

Both the news and Singapore police statement[1] doesn't mention where the victim bought their Ledger device. It makes me wonder if they bought from CryptoBills (reseller in the main incident).

Could be but I’m sure of another store Metapod which  was is  also an official reseller [Asia & Ocenia > Singapore .. you will find Metapod listed there ], reported by @BenYorke on X
Let me save you the time :

I have a $300 @Ledger Flex that I bought from the Singapore airport in summer (Metapod, should be fine?)

I never plugged it in but it looks like theres some scratches on the casing, an indication of potential tampering?

Sent it to Mark Karpeles who eventually opened it live and confirmed implant: YT vid.. a perfect one btw.

Another one was Challenger[first on the official reseller list], someone reported but i can’t remember where I found it and the location that was in the report but I’m sure a user  would have posted it on the forum..

[PX-Z]

Had it been it was earlier taken serious earlier since September 10 and the information was passed across to all crypto platform before the major incident, maybe the Ledger scenario would have only comprises of the two affected users than the entire massive affected users, before the final burst this October.

Who knows, there is no final or exact start date publicly announced by Ledger or law enforcement regarding when the distribution of the compromised hardware wallets began, so its won't matter. What matter is why this incident never goes through the company (Ledger), or they just ignore it?