Slashdot has reported:

Ledger has confirmed that some of its hardware wallets distributed through Southeast Asian reseller CryptoBilis were compromised by an implant that drained users’ cryptocurrency wallets. The company had been investigating reports of people losing funds from wallets bought through the retailer, a major Malaysia-based hardware wallet seller operating across Southeast Asia.

Researchers said the tampered Ledger X devices had been available since September 16, at prices close to half the cost of the original hardware. A report published over the weekend by Tibane Labs described how the threat actor made space for the circuitry by replacing the device’s original battery with a smaller one. The replacement battery powers both the implant and the Ledger X.

“Under the battery and antenna sits an ST STM32G431KBU6 (Arm CortexM4, 128 KB flash, UFQFPN32),” the researchers found inside one device. They also identified the communications components: “a tiny eSIM, an 8pad package just 2x2 mm, next to the MCU, and a shielded LTE module that sends the words out.”

Ledger is advising customers to avoid unauthorized resellers because their products carry an increased risk of being counterfeit or modified. The company also told its authorized resellers and distributors to source products only through authorized channels and not to restock returned devices.

Ledger offers a “Genuine Check” mechanism to assess whether a device is authentic. The company warns, however, that the check cannot detect an added implant if the device’s original Secure Element remains intact. The account was shared by longtime Slashdot reader AmiMoJo, citing a report from BleepingComputer.