Crypto hardware wallet firm Ledger has discovered a disturbing detail in its investigation into alleged crypto thefts. It has found that at least one piece of hardware had been tampered with by the insertion of a rogue piece of hardware.

Ledger's latest update, which was posted on Oct. 10, says it found the rogue hardware inside one of the affected users' devices. It was from the recent CryptoBilis security incident. CryptoBilis is an authorized reseller in Southeast Asia.

It is the first piece of concrete evidence of hardware tampering during the investigation. It is a frightening prospect that some Ledger wallets might have been tampered with surreptitiously before their users received them.

Whether or not this implant had anything to do with the alleged thefts, or how many devices might be affected, is still unclear.

Additionally, Ledger says CryptoBilis has ceased sales of all hardware wallets as a precautionary measure until the investigation is over.

Ledger says it is in touch with affected users and working with law enforcement to hunt down the culprits.

The alleged attack is particularly worrying, as it does not even necessarily mean the attackers had to hack into the secure element (that is, the chip inside the Ledger device that generates and secures the private keys). The alleged rogue hardware is supposed to tap into the communication lines between different internal parts of the wallet and the screen.

Ex-Mt. Gox CEO hunting down mysterious spy implant

The discovery comes as Mark Karpelès (ex-CEO of defunct crypto exchange Mt. Gox) has been investigating the alleged mysterious hardware discovered in Ledger wallets.

Karpelès posted on Oct. 10, saying he had independently been able to locate these hardware modifications. He had been looking at pictures sent to him by the affected users.

"I have confirmed this too from pictures sent to me by affected users," Karpelès said on X.

He encouraged people who had these devices and were willing to donate them for analysis to reach out to him directly.

In an update, Karpelès said he had actually dismantled one of the suspicious hardware components found in a hardware wallet to analyze it.

"Dismantling a spy implant from a crypto wallet is probably the most cyberpunk thing I did this year," he joked.

Previously, Karpelès had reported that a Ledger Nano X device (from Malaysia) he had examined contained a hidden electronic component, even though it came in what appeared to be intact shrink-wrap packaging.