Ledger confirms a hardware implant in one wallet caught up in the $93 million CryptoBilis drains

Ledger said "one of the impacted users' devices contained an unauthorized hardware implant" ^[2]. It is the first physical tampering the company has confirmed in this episode ^[17], and it covers one device ^[1]. The two loss counts that device has to explain agree on dollars and diverge on addresses. Yfarmx puts suspected losses at $93.4 million across 471 addresses ^[3]. Bitquery puts them at about $92.9 million across 311 unique addresses ^[4]. That works out to roughly $198,000 an address on the first count and $299,000 on the second ^[18]. If Yfarmx's list contains Bitquery's, which is an assumption, the extra 160 addresses held about $3,100 each on average ^[20]. Ledger has not verified either figure ^[5].

Ledger's defence and the victims' losses can both hold because of where the reported attack was aimed. The device Karpelès documented ^[8] reportedly watched the data travelling to the display during setup, captured the recovery words and sent them out over a cellular connection, without attacking the secure element ^[9]. Ledger said: "We have no indication that Ledger's security infrastructure, systems or services have been compromised" ^[7].

From here the case can go two ways. If investigators find comparable implants in most of the affected wallets, the roughly $93 million ^[3][4] becomes a hardware loss traced to one reseller's stock. The question of who pays would then turn to whoever controlled that stock. A handful of implants would explain a slice of the losses and leave the rest needing another cause. The reported statement does not say where between factory and customer the implant was fitted, or whether Ledger will repay anyone.

We think the evidence supports suspicion of CryptoBilis stock and stops there. One tampered device shows that compromised hardware reached a victim. It does not show that every third-party channel is compromised, and Ledger's warnings so far are addressed to CryptoBilis purchasers ^[12]. An implant found in a wallet bought through a different reseller would prove that view too narrow.

Users on Ledger's X thread are already pushing past the investigation. Several asked, "Are you gonna refund the victims?" ^[15] One wrote, "Isn't this your responsibility since they were official authorized reseller from you? You bear that responsibility to compensate victims" ^[16].