The investigation into tampered Ledger hardware wallets is expanding beyond the Southeast Asian reseller at the center of the original CryptoBilis incident, but the evidence remains uneven. A public catalog compiled by former Mt. Gox CEO Mark Karpelès lists devices that buyers and researchers have reported finding with unauthorized components, including units reportedly purchased in Germany and Russia.
The catalog, Ledger Implant OSINT, listed 15 devices associated with nine named sellers as of October 15, according to the page. Its entries link to publicly reported cases and images, offering a way to compare reported findings across device models and purchase channels. The number represents entries in a community-maintained catalog, not a count independently verified by Ledger or a confirmed total of compromised devices.
The developments come as Ledger investigates the CryptoBilis-linked incident, in which the company confirmed finding an unauthorized hardware implant in one affected user’s device. In an October 13 technical update, Ledger’s security team explained how an implant could capture a recovery phrase displayed during setup and transmit it over a cellular connection. The company has not confirmed that the separate European reports are connected to the CryptoBilis-linked fund drains.
An Open-Source Catalog of Reported Implants
Karpelès published the catalog after sharing images of suspicious hardware found inside a Ledger device. In his October 14 post on X, he described the page as a reference for tampered and fake Ledger wallets and the places where they were bought.
The catalog distinguishes between devices described as genuine Ledger products with an added circuit and devices described as counterfeits. That distinction matters: a counterfeit device and a genuine device modified after manufacture are different cases and should not be treated as evidence of the same supply-chain pathway.
According to the catalog, reported devices span several Ledger models, including the Nano X, Nano S Plus, Flex, and Stax. The listed purchase channels include sellers in Southeast Asia, Japan, and Europe. Some entries refer to devices bought through marketplaces or third-party sellers; a seller or retailer appearing in a report does not by itself establish that the seller knowingly supplied a modified device or that the modification occurred at that point in the distribution chain.
The European reports are particularly significant because they raise questions about whether similar modifications may have reached buyers outside the original Southeast Asian cases. The catalog includes reports involving Nano X devices said to have been bought at MediaMarkt in Germany and through Russia’s Ozon marketplace. These entries should be taken by readers as reported findings recorded in the catalog, rather than as independently confirmed cases. The catalog’s labels reflect the evidence and status recorded by its contributors; they are not equivalent to a forensic finding published by Ledger.
Some catalog entries also show markings that contributors interpret as version identifiers for different devices or regions. Those markings may help researchers compare reported hardware, but they do not establish who manufactured the components, how widely they were distributed or whether all devices came from a single operation.
Karpelès has also cautioned against treating the catalog as comprehensive. Public reports are inherently selective: buyers who identify suspicious hardware may post photographs, while people who suffer losses may not disclose their cases publicly. Conversely, an image or allegation posted online may not provide enough evidence to establish that a device was tampered with.
The catalog is therefore a reference for publicly reported cases, not a verified inventory of every affected device or a measure of total financial losses. Its absence of a particular model, seller or purchase channel should not be interpreted as proof that the device or channel is safe.
Tools to Check a Device
Alongside the catalog, a developer known as Yishi has publicized a utility intended to help users examine photographs of hardware-wallet circuit boards for signs of modification. The tool has been described as supporting Ledger, OneKey, and Trezor devices.
A photo-based check can only identify features visible in the submitted image; it cannot guarantee that a wallet is genuine or free from tampering. Its reliability depends on image quality, the device model, the reference material used and whether the modification is visible from the photographed angle.
Users should exercise caution before uploading images to any third-party service. Do not submit a recovery phrase, private key, PIN or other wallet secret. Review the tool’s privacy and data-handling terms before uploading a circuit-board photograph, and do not treat a third-party result as a substitute for advice from the manufacturer.
The broader security concern is supported by Ledger’s own technical findings in the confirmed CryptoBilis case. In its October 13 update, Ledger said the unauthorized component could read information displayed on the device screen during setup and transmit the recovery phrase over LTE using a provisioned eSIM. That technical explanation applies to the implant Ledger examined; it does not establish that every device appearing in the public catalog uses the same design or works in the same way.
Binance co-founder Changpeng Zhao also commented on the incident, advocating that hardware wallets should use transparent cases in the future. That is a proposed design response, not an established industry standard or proof that transparent cases would prevent every form of hardware tampering.
Ledger’s Findings Differ From the European Reports
The European entries in Karpelès’s catalog contrast with Ledger’s public statement about its checks in Germany.
In an October 14 update on X, Ledger said its team had inspected devices from retail and distributor stock across Germany, including stock from stores named in reports, and found no signs of tampering. The company also said no implant-related losses had been reported anywhere in Europe.
Ledger’s statement concerns the stock it inspected and the losses reported to it; it does not establish that every device previously sold through a European retailer is untampered. The catalog, meanwhile, records individual devices that buyers say they purchased and opened. Those are different sets of evidence.
Ledger also said it had not yet been able to examine the devices shown online and invited their owners to submit them for inspection. Until the specific European devices are examined and the findings made public, their status remains unresolved. The catalog’s entries should not be treated as equivalent to Ledger’s own forensic confirmation, but Ledger’s stock checks also do not independently disprove the reports about individual devices.
The Russian marketplace report requires the same caution. A buyer’s post or a catalog entry may document an allegation and provide photographs for further analysis, but it does not establish that Ozon itself modified a device or knowingly distributed compromised hardware.
The next evidentiary step for users is examination of the specific reported devices, followed by disclosure of what the analysis establishes about the components, their origin, and any relationship to the confirmed CryptoBilis case.
Confirmed Findings, Unverified Reports, and Loss Estimates
The growing number of posts about suspicious devices has made it important to separate confirmed findings from unverified claims. Ledger has confirmed an unauthorized implant in at least one affected user’s device linked to its CryptoBilis investigation. The company’s technical explanation describes how the implant could read the recovery phrase from the screen and transmit it through a cellular connection.
That finding does not automatically validate every other device report, nor does it establish that all reported wallet drains resulted from the same hardware modification.
Some online posts have also questioned the authenticity of additional reports and suggested that fabricated claims may be circulating. Such claims require evidence of their own. Neither the existence of a confirmed implant nor the possibility of misleading online posts is sufficient to determine the status of a separate device without examining the underlying evidence.
Estimates of cryptocurrency stolen in the original incident have varied, with third-party analyses placing losses in the tens of millions of dollars. Ledger has not confirmed a final total, and the number of entries in Karpelès’s catalog should not be used to estimate financial losses. The catalog tracks reported hardware findings; loss estimates are a separate question requiring transaction analysis and confirmation of which cases are connected.
What Hardware-Wallet Owners Should Do
The case highlights the importance of hardware integrity and the risks associated with devices that may have been altered before reaching a buyer. It does not establish that all Ledger products or all third-party retailers are compromised.
Ledger has advised customers who purchased devices through CryptoBilis during the period specified by the company not to initialize unused devices. Customers who have already used a potentially affected device should follow Ledger’s official guidance, including considering a move to a new device with a newly generated recovery phrase.
Buyers should use the manufacturer’s official store or verified sales channels, inspect a device for signs of physical modification before setting it up, and contact the manufacturer if anything appears suspicious. A device passing a software authenticity check should not be treated as conclusive proof that its physical components have never been altered.
Never enter a wallet recovery phrase into a website, third-party checker, online form or support chat. Anyone who obtains a recovery phrase may be able to restore the wallet and control its assets.
The Crypto Times will update this report as additional verifiable information becomes available. The publication has repeatedly contacted Ledger for comment and is still awaiting a response.
Also Read: Ledger Halts Sales in 7 Asian Markets as Tampered Flex Surfaces in Singapore
