Ledger implant found at two more resellers, researcher says

The seed-stealing implant first found in Ledger wallets sold by Southeast Asian reseller CryptoBilis has also turned up in devices from two other authorized resellers, according to Mark Karpelès, CEO of Tokyo-based Karpelès Lab. He told Unchained's livestream on 15 October that the latest version of the board is designed for mass production. Ledger says the German store stock it checked was clean.

What Karpelès found

• A Ledger Flex bought from Metapod, a reseller with shops at Singapore's Changi Airport, contained a version of the implant customized for the Flex but built the same way: three chips — one reading the screen, a cellular modem, and an eSIM that sends the data.
• A Nano X bought at MediaMarkt in Germany by an X user named Johannes also contained an implant, installed slightly differently from the Southeast Asian units. "It's surely the same implant," Karpelès said.
• The newest boards simply clip into place — on the Nano X it "will basically just fall into place" — which he said points to months of well-funded development. He expects "a lot more of it" and suggested tamper-evident packaging rather than scrapping reseller programs.

Ledger said on 14 October that it had inspected retail and distributor stock in Germany, including the stores named, and that "none showed any sign of tampering," adding it had not yet examined the devices shown online.

Panic is now the bigger risk

On Unchained's Uneasy Money podcast, security researcher Taylor Monahan said the reports she had worked on in recent days "are not actually Ledger drains." Instead, worried owners fell for bad Google ads for Ledger Live, fake apps, phishing sites, scare emails and phone calls. "Don't panic," she said. Bitquery counts $102.0 million taken from 324 wallets in the original wave; Ledger has not confirmed a total. Background: our reports on Ledger's investigation and Trezor's reseller cuts.