Ledger thefts: can a wallet with added hardware still be trusted?

1 The current thefts and the earlier teardowns

In its October 11 update, Ledger linked all then-confirmed cases in the October 9 draining incident to CryptoBilis-sold devices. It described the affected device volume as limited, said its own systems and direct sales were unaffected, and reported that CryptoBilis had stopped all hardware-wallet sales. The statement supplied no device count, complete model list, implant design or loss total. For the confirmed victim device, forensic details are still needed to establish exactly how information escaped and where the alteration entered its journey to the buyer.

A separate technical trail predates this incident. Joe Grand presented a teardown of an implanted Nano X at hardwear.io in May, following a public lead dating to August 2025. Tibane Labs obtained two more specimens in September, one through Yahoo! Auctions in Japan and another through an Amazon Japan third-party seller. The lab explicitly says it has examined no CryptoBilis-sold device. Those specimens establish how this class of attack can work. Connecting them to the October victim hardware requires further findings from Ledger's investigation.

2 Recovery words have to reach the screen

The secure element generates and holds secrets, then signs when the user approves. During initial backup, however, the owner must write down the recovery words. A Nano X turns those words into pixels and sends them to its OLED. Page 40 of Grand's original slides identifies the connection as SPI, a serial bus between the chip and display. Added circuitry on that path can listen to the data while the display continues to work.

Pixels do not announce that they contain recovery words, but fixed letter shapes provide recognition templates. The firmware analysis on pages 68–72 shows the sequence: a–z glyphs at 0x4D00–0x4E40, template matching, recovered-word records in Flash at 0x7000, and transmission through the cellular module. Those offsets belong to that implant firmware and cannot be applied to other specimens.

Secure element → display pixels → OLED
                              ↘ added circuit reads
                                glyph matching → word records → cellular module

The unsettling part is how much can keep working correctly. The chip generates a random secret, the screen shows the right words, the owner writes the backup, and subsequent signing works. The extra circuit copies information that must already appear. With its own modem, SIM and antenna, it can obtain connectivity through cellular service. A computer firewall has no outbound request from the computer to inspect.

Page 75 of Grand's slides still lists monitoring cellular transmissions as future work. The published analysis reaches the firmware sending path and radio hardware. Verifying a complete cellular transmission still requires capturing and decoding it. The diagram below explains that display-interception structure.

3 What a successful Genuine Check establishes

Ledger's Genuine Check performs a specific cryptographic task. During manufacture, the secure element generates an attestation key pair. Ledger signs the public key under its root of trust. Later, a server sends a random challenge, the chip signs it, and the server verifies the certificate and response. Donjon's official threat model explicitly states that unauthorized physical modifications, including spying implants, can escape this check when the original secure element remains intact.

Read the question precisely: can this chip answer a challenge using its factory-established secret? The added circuit can leave that task to the chip. It needs neither to impersonate the chip nor extract its attestation key. Keeping the original chip for authentication and observing a separate display connection satisfies both the authentication condition and the interception condition. A green software result covers the object the software actually tested.

Running the check again therefore offers little insight into whether circuitry was added during shipment or resale. An intact cardboard box takes no part in signing the challenge. Device provenance, returned-stock handling and access to inventory still affect the integrity of the delivered product. An authorized-reseller list helps buyers choose a channel. Vendors still need to scrutinize stock handling and changes of control.

The September specimens also show why a casual physical inspection can become harder. Tibane's second specimen conceals a black-coated flex board beneath the OLED, retains the original battery, has some chip markings abraded, and uses a marked nRF9151 cellular module with a custom antenna. Its published bus capture reconstructs the startup display, with deeper analysis of both newer specimens still ongoing. The photographs show a purpose-built structure suited to repeat installation. They leave the manufacturer unidentified and cannot assign that revision to every drained wallet.

4 Restoring old words on new hardware preserves the keys

The coins are not stored inside the USB device. The chain records balances and spending conditions, while the device holds the secrets needed to sign. Recovery words make those secrets portable enough to back up. Someone holding the words and any passphrase used can reconstruct the wallet elsewhere. Replace the hardware while keeping the same words and passphrase, and the chain still recognizes the same authority.

BIP39 defines the conversion: normalized mnemonic words go into PBKDF2, with mnemonic plus the passphrase as salt, HMAC-SHA512, 2,048 iterations and a 64-byte output seed. This optional passphrase serves a different purpose from the PIN that unlocks a device. The PIN is absent from the derivation.

seed = PBKDF2-HMAC-SHA512(
  NFKD(mnemonic), NFKD("mnemonic" + passphrase),
  iterations = 2048, output = 64 bytes
)

The seed is the starting material for account keys. BIP32's deterministic derivation produces a master key, then derives keys along account paths. Following identical rules and paths reconstructs identical keys. A local check using BIP39's public test vector reproduces the same seed from identical words and passphrase, and a different seed when the passphrase changes. Changing a device PIN cannot affect the formula. That explains the practical difference between importing old words into new hardware and generating fresh words there. The check uses public test data and no user wallet.

A passphrase is another secret required to access the accounts derived with it. Someone holding only the recovery words still needs that passphrase. Ledger's passphrase guide explains that it creates separate accounts: funds in existing accounts do not move automatically. Whether an implant can read a passphrase depends on its input and display implementation and where the circuit is attached. The display research supplies no passphrase-capture record from this incident's victim device. Recovery should still begin with a fresh backup generated on trusted hardware, followed by an asset transfer.

This also explains a common route to a second loss. After a wallet is drained, a friend or business partner may continue paying its old address. If the attacker has the keys, those new funds remain under the same control. Replacing receiving addresses and updating payers' records belong to the same recovery as moving the existing balance.

5 An empty wallet can still carry dangerous authority

Bitquery's October 12, 14:00 UTC update estimates the October 9 drain at $102.0 million from 324 deduplicated wallets across six chains, valued at October 9 prices. The wallet count cannot be read as a victim count because one owner can have several addresses. This is the investigator's tally, without a confirmed Ledger loss total or an independent full recount by SOSEC.

Some victims can retain their keys yet lose the ability to operate an account. The investigation records 30 TRON accounts adding the same control key within seconds while leaving their original owners' keys unable to meet the signing threshold alone. Under TRON's permission model, the sum of signing weights determines whether a transaction is authorized. The attacker's weight reaches the threshold and the owner's falls short, leaving the owner unable to reverse the change alone even with the original key. The owner permission provides the highest account authority, while active permissions can be assigned specific operations. Inspect their authorized keys, signing thresholds and allowed operations to establish the original key's remaining control.

Token allowances add another layer of state. TRON's TRC-20 interface uses approve, allowance and transferFrom to record who may withdraw how many tokens from an account. The fresh 70,000 USDT payment that Bitquery records as stolen on October 10 was on TRON, taken through the previous day's USDT allowance, and is excluded from the October 9 total above. Revocation clears that record. If the words and any passphrase used have also leaked, someone with the signing key can authorize again. Changing a local PIN or reinstalling an app leaves the token contract's allowance untouched. Recovery needs a view of keys, account permissions and token approvals to establish what the owner still controls.

Read freezes just as carefully. Bitquery's October 12, 12:52 UTC snapshot records about 10 million USDT still frozen. A freeze prevents movement. Returning the funds still requires further action. That amount cannot be booked as compensation paid. Transaction hashes, addresses, purchase records and device provenance allow a victim's specific losses to be reconciled with later freezes or returns.

6 Recovery begins with trusted hardware and fresh words

Ledger's October 11 guidance is concrete: CryptoBilis buyers should leave uninitialized devices unused, and existing users should move to a new seed on a device obtained from Ledger. The initial October 9 notice referred to purchases in the previous 90 days. The later buyer warning no longer used that cutoff. Devices purchased outside that initial 90-day window are also within the later warning. Repeatedly displaying recovery words on a suspect device is a poor way to investigate it.

Migration must change the on-chain destination. Generate a fresh backup on trusted hardware, verify its receiving address on the device, and transfer assets still under your control. Keep the old words as investigation material and stop accepting new payments into the old wallet. Where altered TRON permissions prevent the original key from acting alone, preserve the current permissions and related transactions, contact official support and avoid adding more funds. After moving tokens, check other chains, staking accounts and receiving records still in use.

The reseller also carried other brands. OneKey's October 12 statement revoked CryptoBilis authorization and announced a reseller review, while reporting no related OneKey-user thefts at that time. Devices bought there from March 1 through the statement date qualify for free replacement with proof of purchase, requested by December 31. That precaution has its own brand and date scope. It establishes neither matching implants in other brands nor completion of an asset migration.

What makes this class of implant difficult is that familiar checks can all look normal: the original chip is present, attestation succeeds and signing works. The extra circuit only needs to wait for the device to display its backup as designed, then copy the words. A secure element can protect secrets inside it. Once those secrets reach a screen, protecting them also depends on the integrity of the whole device and its delivery chain.