Ledger wallet implant linked to $93M theft; npm Trusted Publishing flaw exposes 1,500+ packages

1. Executive summary

A hardware implant soldered inside Ledger Nano X and Flex cryptocurrency wallets, sold through the Southeast Asian reseller CryptoBilis, intercepted on-screen seed phrases and exfiltrated them over a built-in modem and eSIM, with on-chain researchers attributing more than $93 million in losses to the campaign. Separately, CVE-2026-96951, a command injection flaw in Windows Shell rated CVSS 8.8 HIGH and listed in CISA KEV since 2026-10-13, is being exploited in the wild as a Mark of the Web bypass and is the item with direct enterprise exposure for EMEA financial services clients. The Ledger implant affects retail hardware wallet holders rather than corporate estates, but it is a supply-chain integrity failure with a named reseller and a documented tampering technique that treasury and digital-asset desks holding self-custodied crypto should treat as an active loss event. No MITRE ATT&CK profile is associated with any actor in this item, so no attribution is confirmed.

2. Regulatory framing

3. Technical analysis & attack chain

Two distinct events are covered here. They share no infrastructure and no actor.

Ledger hardware implant (supply-chain tampering)

1. Tampered Ledger Nano X (and, in at least one reported case, Ledger Flex) devices were sold to customers in Southeast Asia through the reseller CryptoBilis.
2. A spy chip was soldered between the cryptographically secure element that handles cryptocurrency operations and the device's screen.
3. The implant intercepted the data displayed on the screen, matched characters against a character map, and transmitted the recovered information to a remote attacker using a built-in modem and eSIM card.
4. The threat actors used the collected seed phrases to access and drain the associated cryptocurrency accounts.
5. On-chain researchers put suspected losses at more than $93 million. A separate figure of more than $86 million in stolen crypto assets is attributed to the backdoored devices in the Tibane Labs reporting. The two figures are not reconciled in the sources.

The implant's construction changed over roughly a year. Early samples (from September of the prior year) used hand soldering and off-the-shelf components, and required replacing the original battery with a smaller one to make room in the casing. The newer samples use a laminated flex PCB painted the same colour as the regular Ledger components, keep the original battery, and gain space by removing some of the foam padding. Tibane Labs described the newer build as the most advanced implant seen so far, noting that with the case open and the screen in place it looks like an ordinary Nano X, with the only visible giveaway being a thin black antenna wire running along the top edge.

Ledger's 72-hour update on X, dated October 11, stated that all confirmed cases related to the disclosed draining incident of October 9, 2026 involved devices sold through CryptoBilis, and that Ledger's own systems and direct sales channels were not affected. Ledger told customers to discard and replace devices bought from CryptoBilis and to move funds to new blockchain addresses. Ledger has stopped working with CryptoBilis pending investigation. CryptoBilis says it is cooperating and has suspended all Ledger device sales.

Windows Shell command injection (CVE-2026-96951)

CVE-2026-96951 is a command injection vulnerability in Windows Shell, rated CVSS 8.8 HIGH, classified CWE-77, and listed in CISA KEV with an addition date of 2026-10-13. EPSS is 2%. It can be triggered by a remote attacker via a file designed to exploit the vulnerability, and it functions as a Mark of the Web bypass, meaning the file can execute without the warning Windows normally attaches to content downloaded from the internet. Microsoft fixed it as part of a Patch Tuesday release that addressed over 1,400 security bugs. No further mechanism detail, affected build list, or proof-of-concept is present in the source material.

Unconfirmed and single-sourced claims

The technical description of the implant rests on a single vendor report from Tibane Labs, relayed by Risky Business News; the soldering evolution, the flex PCB construction, and the modem/eSIM exfiltration path are single-sourced and should be verified against Ledger's own advisory before being used in enforcement or customer communications. The reported ownership change at CryptoBilis, in which co-founder Arravind Prabu said he sold the company earlier in the year under an NDA and online reporting alleges the new owners are a Chinese company, is unverified and rests on a public statement and secondary reporting. A single Ledger user reported finding the same implant in a wallet bought in Europe; it is unclear whether that device came from a European manufacturing batch or from CryptoBilis stock resold or shipped into the EU to cover shortages. A Ledger Flex sold at Singapore Airport was reported to contain an implant, described as an isolated case at the time of reporting. No actor is named in any source, and no MITRE ATT&CK profile is associated with this activity, so attribution is unconfirmed.

4. Mitigation & containment

P1 (within 24 hours)

• Treat CVE-2026-96951 as exploited. Apply the Microsoft Patch Tuesday update that resolves the Windows Shell command injection flaw across all Windows endpoints and servers. This is a CISA KEV entry with confirmed in-the-wild exploitation; do not defer it behind change-window scheduling.
• Hunt for Mark of the Web bypass behaviour: files that executed from internet-origin locations (browser download directories, email attachment caches, %USERPROFILE%\Downloads, %TEMP%) without the expected Zone.Identifier alternate data stream or with a stripped or altered one. Windows Shell command injection means the trigger is a file, so correlate file-write events with immediate child-process creation from explorer.exe or shell32-related parents.
• For any client or staff member holding self-custodied crypto on a Ledger device purchased through CryptoBilis, follow Ledger's instruction: stop using the device, move funds to new blockchain addresses generated on a device from a trusted source, and discard the tampered hardware. Do not attempt to reuse the seed phrase on the suspect device.

P2 (within 72 hours)

• Inventory hardware wallet and signing-device acquisitions across treasury, digital-asset, and personal-use-adjacent functions. Record the reseller, purchase date, and serial where available. Devices sourced through CryptoBilis or through secondary/resale channels with unclear provenance should be treated as suspect.
• Physically inspect any Ledger Nano X or Flex in scope for the documented giveaway: a thin black antenna wire running along the top edge of the casing. Any device showing it should be removed from use immediately.
• Add the reseller channel to third-party risk tracking under DORA Art. 28 and record the vendor's suspension of CryptoBilis as a supply-chain control event.

P3 (within 7 days)

• Where hardware wallets are used for institutional custody, move to direct-from-manufacturer procurement and require tamper-evident packaging verification on receipt. Document the verification step so it is auditable under NIS2 Art. 21(2)(d).
• Review endpoint detection coverage for Windows Shell abuse and confirm the patched build is reported in asset inventory rather than assumed from patch deployment success.
• Brief finance and treasury staff that seed phrases are the compromise target and that a device which displays correctly can still be exfiltrating what it displays.

5. Indicators of compromise

No atomic indicators (hashes, domains, IPs, file paths) are present in the source material. The sources describe observable behaviours only.

No indicators of compromise available in the source material.

6. Detection

The sources contain no file hashes, mutex names, registry keys, scheduled-task names, or hard-coded implant strings. The only machine-checkable artefacts are the Windows Shell exploitation behaviour and the physical implant characteristics, neither of which yields a defensible YARA string set. A YARA rule built on the CVE identifier, the product name, or the reseller name would detect reporting about the threat rather than the threat itself, so none is emitted.

Insufficient indicators to author detection rules.

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV)

7. Sources

• Help Net Security, "Week in review: Hidden implant in Ledger wallets linked to $93M theft, 1,500+ npm packages exposed", https://www.helpnetsecurity.com/2026/10/18/week-in-review-hidden-implant-in-ledger-wallets-linked-to-93m-theft-1500-npm-packages-exposed/, 2026-10-18
• Help Net Security, "Hidden implant in Ledger hardware wallets linked to $93M theft", https://www.helpnetsecurity.com/2026/10/12/ledger-wallets-compromised-via-hardware-implant/, 2026-10-12
• Risky Business News, "Risky Bulletin: Spyware chip found in Ledger crypto-wallets", https://news.risky.biz/risky-bulletin-spyware-chip-found-in-ledger-crypto-wallets/, 2026-10-13
• NVD, CVE-2026-96951, CVSS 8.8 HIGH, CWE-77
• CISA KEV, CVE-2026-96951, added 2026-10-13
• EPSS, CVE-2026-96951, 2%

8. Adverse Trace position

CVE-2026-96951 is the item that matters for EMEA financial services estates: CVSS 8.8 HIGH, CWE-77 command injection in Windows Shell, confirmed exploited in the wild and in CISA KEV since 2026-10-13, with a Mark of the Web bypass that removes the user-facing warning normally relied on as a last line of defence. The Ledger implant is a serious supply-chain integrity failure with more than $93 million in attributed losses, but its blast radius is retail hardware wallet holders and self-custody desks, not general enterprise infrastructure, and the technical detail behind it is single-sourced to Tibane Labs via Risky Business News and should be verified before it is used in enforcement. No actor is named and no MITRE ATT&CK profile is associated with either event, so we make no attribution. We will track Microsoft's remediation guidance for CVE-2026-96951 and any expansion of the KEV entry, monitor Ledger's advisory and the CryptoBilis investigation for a confirmed device serial range or batch identifier that would let clients scope affected hardware precisely, and update this advisory if a second independent source corroborates the implant's construction or the reported change of ownership at the reseller. Clients holding self-custodied crypto on devices from the affected channel should action the P1 steps in section 4 today rather than waiting for that corroboration.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.