In downtown Kuala Lumpur, a paper sign dated Oct. 10 on a closed crypto storefront said its physical stores were temporarily shut until further notice. By then, missing funds were already being reported on Oct. 9, and blockchain researchers were estimating more than $90 million had been stolen.
CryptoBilis, a Malaysian retailer that resells hardware crypto wallets, is now a key focus of the probe into thefts from devices meant to keep digital assets offline. Paris-based Ledger SAS, the manufacturer of the affected wallets, announced Thursday that a "highly organized criminal group" had built covert components into certain devices. Previously, the company traced the problem to CryptoBilis; however, it is now examining reports of comparable implants in units purchased from other outlets, suggesting the scope may exceed one reseller.
A Ledger spokesperson said the firm has launched an investigation, is coordinating with local authorities, and will provide further details as they become available. Requests for comment sent to CryptoBilis went unanswered.
Social media investigators have outlined a likely playbook. In their accounts, a secret module captures passcodes shown on Ledger screens, then sends those keys over cellular networks to attackers, who use them to access funds from other devices.
Ledger's hardware includes a protection chip, yet experts say the implant sidesteps that defense and slips past routine checks until the damage is done. The unnerving twist is physical tampering, not a software or data leak, and the full scope remains unclear even after Ledger's Thursday update.
This flare-up lands after a rough stretch for "cold wallets," the offline devices that store private keys. Over the summer, a flaw in devices made by Coinkite Inc. led to an estimated $130 million in Bitcoin being stolen, and soon after, Trezor reported a shipping-provider breach that exposed personal data for about 67,000 customers.
Ledger has rolled out several wallet designs over the years, including a new model it is marketing at $899. Legacy models, including the Nano X, occasionally make their way to intermediaries such as CryptoBilis, which then refurbish and put them back on the market.
According to Ben Yorke, a crypto professional based in Kuala Lumpur, he purchased a Ledger Flex from a Metapod outlet located in Singapore's Changi Airport. Before he set it up, he noticed what looked like tamper marks. "I noticed the subtle but suspicious markings on the side, indicating someone may have tried to pry open the back of the device," he said.
With so much to follow in markets, sign up for the free Market Briefs and get clear updates in five minutes daily
He later shipped the unit to Mark Karpelès, a founder-turned-researcher who runs Tibane Labs and previously led Mt. Gox. Based in Japan, Karpelès in 2019 received a suspended sentence for tampering with financial records tied to Mt.
Gox's collapse, and he was cleared of embezzlement. He was among the first to offer help to victims of the Ledger hack, and after examining Yorke's device he found a custom connector tapping the display, plus a cellular chip and SIM card. "This is not your guy in a garage putting implants on a Ledger," Karpelès told Bloomberg.
"This is the kind of scale you see in spy movies."
Two takeaways. First, hardware is one link in a long chain. Aneirin Flynn, CEO of cybersecurity technology firm FailSafe, put it plainly: "Protecting against one type of attack doesn't eliminate the others." Second, process risk is real. As Esme Pau, CertiK's head of capital markets and policy, said, "This reveals that crypto storage is an operational risk, not just a cryptographic one."
In plain English: cold wallets reduce online risk, but recent episodes - implants, a $130 million haul tied to Coinkite flaws, and a Trezor vendor data leak - show attackers can reach private keys through supply chains and handling. If crypto is in your portfolio, the risk runs through how and where wallets are sourced, shipped, stored, and set up.
Because small details can matter for investors, join the free Market Briefs newsletter for concise context in five minutes a day
