TronscannerThird generation: The insights gained from the teardowns of the Ledger spy implant
Editor's note: this article is based on independent teardowns and unofficial sources. Ledger has not published its own technical analysis, and the link between the implants described below and the reported thefts has not been proven.
The headline numbers are already well known: an estimated $72–93 million drained from wallets bought through the Malaysian reseller CryptoBilis, and a Ledger statement confirming "an unauthorized hardware implant" in at least one affected device. But the independent teardowns that followed are more revealing than the news itself. The most detailed comes from Tibane Labs, which builds on an earlier teardown by well-known hardware hacker Joe Grand and on Mark Karpelès's description of his own unit.
Their main finding: what investigators are looking at is not a first attempt. It is the third generation of a device someone has been refining for more than a year.
Three generations, one goal
Tibane Labs documented three generations of implants for the Ledger Nano X, going back to the first public report in August 2025. In other words, the scheme was being built and improved long before the CryptoBilis scandal broke.
Early versions were crude. Extra wires were visible, and to make room for the electronics the original Ledger battery was thrown out and replaced with a smaller one. A trained eye would notice this when opening the case.
The latest specimen (September 2026) is professional work. It uses a custom board cut to the shape of Ledger's components, designed for quick installation. It hides under the OLED screen and is coated in black lacquer to match the main board. The original battery stays in place. Even with the case open, the device looks normal.
Tibane reads the custom-cut board as a sign of installation at volume: this is a production process, not a one-off hack.
What's on the board
According to Tibane's photos, a cellular modem sits in the centre. On either side are two chips with their markings scraped off, so neither manufacturer nor model can be identified. An antenna cable runs along the top. A controller and a SIM element complete the set.
Whether that SIM element is an eSIM depends on who you ask. Reports quoting Ledger describe it as an eSIM; Tibane describes it more cautiously as "a modem with a SIM component". Which carrier or supplier is behind it is unknown, and that is exactly why the markings were removed.
How it reads the recovery phrase
This is the most concrete detail. Ledger's screen is connected to the processor over an SPI bus: three or four lines that carry the image the processor wants to display. The implant is soldered to those lines and simply listens. Think of plugging a second monitor into the cable between a computer and its screen.
The controller sees the same pixels as the display, recognises the letters and assembles the words. When the owner sets up the wallet and the 24-word recovery phrase appears on screen, the implant reads it and sends it out over its own cellular connection. The owner's computer and phone are never involved.
Karpelès described his unit, received from Malaysia, the same way: an LTE module, an antenna, an eSIM and a microcontroller soldered to the display's SPI bus.
Where the samples came from
This may be the most important part. Tibane's specimens were not bought from CryptoBilis. One came from Yahoo! Auctions Japan, the other from Amazon Japan via a China-based seller shipping from Malaysia.
So tampered Ledgers are not confined to one shop in Southeast Asia. They have spread through the secondary market, at least as far as Japan, and separately turned up on MediaMarkt shelves in Germany. And the trail keeps leading back to Malaysia, the same country where CryptoBilis operated.
What we can and can't say
Honesty matters here. Tibane's teardowns show the same attack method, but nobody has proven that these exact boards sit inside the wallets of CryptoBilis victims. Ledger has described its finding but has not published a teardown.
One sceptic, admittedly from a competing wallet maker, makes a fair point: to tie a board to the thefts you need a victim's device, a record of what it transmitted, and a proven path from interception to a drained wallet. No one has published that yet.
Still, the picture is taking shape. For more than a year, someone has been modifying Ledger devices at scale, selling them through resellers and marketplaces, and on the third attempt built an implant that is practically invisible without a microscope.
What this means for you
The practical takeaway is blunt: a Ledger bought on Amazon, eBay or any other marketplace is now a lottery. Buy only from the manufacturer's own website. If you already own a device from a third-party seller, move your funds to a new wallet with a new recovery phrase.
The broader lesson is the one we keep coming back to. The secure chip inside a hardware wallet was never broken. The attackers went around it, through the screen and the supply chain. A device you buy once and never check again can't guarantee your safety. A wallet that does not have a physical box to interfere with and is continuously monitored: Ironwallet is distributed only through official app stores, keeps keys inside your phone's secure storage, and lets its AI assistant use them only locally through a restricted MCP layer that has no command to read them. And we keep auditing it, because the people behind this implant clearly kept improving theirs.
