The check does not see the implant. Ledger confirmed one on October 10. Genuine Check still only looks at the secure element, and the 24 words still have to cross to the screen.
On October 10, @Ledger_Support posted that one of the impacted users’ devices contained an unauthorized hardware implant. The post is https://x.com/Ledger_Support/status/2108968264055345381. When I read it this morning it had 1,743 likes, 384 reposts, and 433,481 impressions. CryptoBilis had stopped selling hardware wallets. Ledger said it had no indication its own systems were compromised. People who bought from that reseller should not set a device up. If they already had, move the coins to a new seed.
On October 11, @Ledger posted the 72-hour update. https://x.com/Ledger/status/2109331538072494364. When I read it, 1,718 likes, 316 reposts, 470,631 impressions. Every confirmed case tied to the October 9 draining involves a device sold through CryptoBilis. Direct sales were not affected. The volume of impacted devices is “limited.” They did not give a number. They told resellers not to restock returned products, and they told CryptoBilis buyers to move to a new seed on a device bought from Ledger.
@BitcoinNewsCom put the same confirmation in caps the afternoon of October 10. https://x.com/BitcoinNewsCom/status/2108978366959251509. 89 likes, 16 reposts, 17,749 impressions. The dollar figures riding along with that headline are not in either Ledger post.
The words still cross
A Ledger keeps the seed in a secure element. That chip is the part built to resist someone who has the device and a lab. Setup still has to show you 24 words. To put them on the screen, the chip has to send them across.
Ledger’s Donjon page says what Genuine Check actually checks. https://donjon.ledger.com/threat-model/device-genuineness/. An HSM sends a random challenge. The secure element signs it with a key that never leaves the chip. If the signature checks out, Ledger Wallet will talk to the device. If it does not, the app stops. The page says this is how you tell a real secure element from a counterfeit. None of the setup steps, app installs, or firmware updates will run on a fake chip.
Then the page says the limit, in its own words: “a Genuine check cannot detect unauthorized physical modifications to the hardware, such as spying implants, if the original Secure Element remains intact.” The next sentence is the advice. Buying from Ledger or an authorised reseller is safer, because Genuine Check “cannot verify the device’s physical supply chain history.”
The check can pass, and the board next to the chip can still be listening. Both sentences are on that page.
Tibane Labs has been opening Nano X units and writing up what is on the screen wires. https://www.tibane.net/research/ledger-nano-x-implant. They describe a second board that watches the pixels, picks out the letters of the recovery words, and sends them on its own cellular modem. The secure element is not attacked. The device still works. Their line is that the genuine check passes because the element really is genuine.
They count three generations. The first, which they attribute to a teardown by Joe Grand, had loose wires and a smaller battery. The two they bought in September 2026 are harder to see. One came from Yahoo Auctions in Japan. One came from a China-based seller on Amazon Japan and shipped from Malaysia. On that one the chip markings were scraped off, the original battery was left in place, and the extra board sits in the foam gap behind the screen. Tibane says neither unit was bought from CryptoBilis, and that they have no evidence linking those units to the reseller. Ledger has not described the implant it found on October 10. I am not going to treat those as the same board.
What the two write-ups agree on is smaller than the headlines. If the secure element is still the real one, Genuine Check does not look at a chip sitting on the wires to the screen. The words still have to cross that path once, during setup, when the device shows them.
The list still has the name
Ledger’s support note from October 9 says it is investigating lost funds from people in Southeast Asia who bought from a reseller named CryptoBilis. https://support.ledger.com/article/15158192560157-zd. It asked CryptoBilis to pause sales. People who bought in the last 90 days should not start setup. If they already did, move to a new seed. The later posts drop the 90-day line and just say CryptoBilis buyers.
I loaded https://www.ledger.com/reseller this morning. Cryptobilis is still on the authorised list for Indonesia and Malaysia. The label now reads “Cryptobilis- Sales temporarily paused.” The Philippines list does not include them. The pause is on the page. The name is still in the authorised column.
Buy from an authorised reseller, because the check cannot see the supply chain. That is Ledger’s sentence. CryptoBilis was an authorised reseller. The October 11 update says every confirmed case in this draining came through that seller. The check was not built to catch a real chip with an extra board beside it. The list was the control that was supposed to stand in for the check, and the list had the seller on it.
Bitquery’s page, which they say they verified on October 12, counts $93.2 million taken from 315 wallets on six chains. https://www.bitquery.io/investigations/ledger-cryptobilis-hack. They also say 25 TRON wallets signed the same approval within 3 seconds, and that Tether froze $10.0 million in USDT. The same page corrected a lead today. Four TRON wallets they had treated as the thief’s were THORChain vaults, and payments they had linked to Binance belonged to other THORChain users. Ledger has not confirmed the $93.2 million, the 315 wallets, or that the implant caused every drain. I did not trace the transactions. The figure is Bitquery’s, and one piece of it moved this morning.
Ledger’s advice matches the limit of the check. Do not initialize an unused device from that reseller. If the 24 words already appeared on that screen, do not type them into the next device. A new box with the same phrase keeps the leak. Both Ledger posts also say Ledger will never ask for those words. The October 11 update says scammers use incidents like this. I did not go looking for the fake support accounts.
I did not open a wallet. I read the two Ledger posts, the Donjon page, the reseller list, and the lab note. The secure element can be genuine. The screen path can still be tapped. That is the modification their own check says it cannot see.