Ledger Knew About Wallet Implants Prior to Mass Theft

In August 2025, a resident of Thailand purchased a cheap Ledger Nano X to replace its battery, but upon disassembling the device, he discovered additional electronics, wires, and an antenna inside.

Hardware hacker Joe Grand (Kingpin) found that the implant could intercept seed phrases from the wallet's screen and transmit them to attackers via cellular networks without compromising the secure Secure Element chip.

Timeline of disclosure regarding malicious modifications:

• August 17, 2025: First photos of the modified device appeared on Reddit
• March 4, 2026: The researcher notified the company, which was already aware of the threat
• April 24, 2026: An investigation detailing the data theft mechanism was published
• May 29, 2026: Research results were presented at the hardwear.io USA conference
• September 2026: Researchers from Tibane Labs discovered more compact generations of implants

The threat had been publicly known for over a year, and the company received detailed information at least seven months before the mass cryptocurrency thefts occurred.