Factory Sealed – Rekt (Ledger/CryptoBilis hardware implant drains)

What it is

A hardware supply-chain attack on Ledger Nano X and Flex wallets (a Stax implant is photographed but unconfirmed). A small LTE-equipped board is added to the device after it leaves the factory. It sits beside the original Secure Element and leaves it intact. Devices came through authorized and unauthorized channels, including CryptoBilis, MediaMarkt, Lazada, Amazon Japan and a Singapore airport retailer. A trove tracker by Mark Karpelès lists 15 reported devices from nine named sellers.

How it works

• The implant waits for setup and copies each recovery-phrase character as the wallet sends it to the screen. It then transmits the phrase through an LTE module, antenna and eSIM.
• Genuine Check authenticates only the Secure Element. Ledger's own threat model says it cannot detect added hardware beside it. Karpelès says his black-coated unit passed the check in a shrink-wrapped box.
• Hardware evolved from Grand's hand-wired prototype to Karpelès's panelized polyimide flex circuit. That circuit carried an STM32G431KBU6 MCU, a 2×2 mm eSIM and an LTE module, or an nRF9151 modem. A silk-screened part number, AC-A2016-NANO-V1.1, suggests a production run. The Japan-based researcher found 10 of 10 unauthorized-seller Nano X units implanted, across five layouts.
• Visual tells reported: a thin black antenna along the top edge, a smaller replacement battery, and a coated or scraped board. Some units filled the foam-padding space.
• The Japan-based researcher says implant firmware points to C2 servers in an Alibaba-managed Hong Kong data center. He says at least 90 implanted Ledgers were sending seeds in June, about four months before the first drain. This is unverified.

Preconditions / Affected

• Any Nano X or Flex bought through a channel where someone could tamper before sale. Authorized status did not protect buyers.
• Timing matters. Bitquery found more than 80% of victim wallets were first funded from June onward, before Ledger's 90-day notice window began.
• Trezor is not shown to be hit by this implant. Grand did report a Model T bought via Facebook Marketplace whose MCU was swapped to generate one of about a dozen attacker-known seeds.

What to do

The page gives no formal remediation. Actions it supports:

• Check Karpelès's tracker for your seller and model.
• If a device was bought from any reseller (not direct from the manufacturer), consider it suspect. If it was used to generate a seed that holds funds, treat the seed as potentially exposed.
• Physical inspection is the only detection the page describes, since Genuine Check is blind to it. Use the tells above.
• The page's closing point is that the whole chain from factory to hand is the trust boundary.

The page gives no commands or indicators beyond the attacker addresses (e.g. TRON key TEqZsE39aNXRnuTwrXJ9ooWMc87puuZxpK, Ethereum control 0x381825deb972b3d0a031a9ce86902ac8b22df8f2), which are useful for chain monitoring.

Caveats

• The $102M across 324 wallets is Bitquery's estimate. Ledger has not verified it or the victim count.
• Ledger says it has not verified a drain tied to a device bought outside CryptoBilis. MediaMarkt pulled stock after one customer report, with no reported losses.
• CryptoBilis' 100% share transfer on August 3, 2026 to an individual listed as "Jiaming" (BitPinas) postdates the first implants (August 2025). It cannot explain the whole story, and nobody is tied to the implants. Changpeng Zhao's claim that hackers bought the reseller has no published evidence.
• The C2 and manufacturing-hub claims rest on a single anonymous researcher. The Stax photos are unconfirmed.
• Grand says he briefed Ledger on March 4, 2026, and that his teardown and firmware were public by May.
• The page is a rekt.news piece with an anonymous author and relies heavily on secondary reporting (Zero Day, Bitquery).