Ledger has verified that a hardware wallet linked to recent thefts contained an unauthorized hardware implant. All confirmed incidents involve units sold by the Southeast Asian reseller CryptoBilis, which operates in Indonesia, Malaysia and the Philippines.

Incident Overview

The issue first surfaced after users reported missing funds from wallets purchased through CryptoBilis. Ledger’s support team announced on October 10 that one affected device housed a physical implant, marking the first concrete proof of supply-chain tampering for the firm’s products. The company emphasized that its own manufacturing facilities and direct sales channels remain uncompromised.

Scope and Impact

On-chain analysts have traced the drain to between $86 million and $93 million stolen from more than 300 wallets. The losses span multiple blockchains, including Bitcoin, Ethereum and Tron. While Ledger has not disclosed an official total loss, the estimate reflects activity across a broad user base.

Ledger’s Response

Ledger has taken several immediate steps:

  • CryptoBilis has halted sales of all inventory pending the investigation’s outcome.
  • Users who have not yet initialized a device are advised to leave it untouched.
  • Those with active wallets are instructed to generate a new seed on a Ledger device purchased directly from the manufacturer.
  • The firm is contacting affected customers, cooperating with authorities and reminding users that it will never request recovery phrases via phone, direct message or email.

Ledger also reiterated its commitment to reviewing reseller relationships, enhancing anti-tamper mechanisms and promoting stricter chain-of-custody practices across the industry.

Supply-Chain Concerns

The discovery revives broader worries about hardware wallet security. Earlier this year, a firmware flaw in Coldcard devices enabled the loss of an estimated $100 million to $130 million in Bitcoin. The current incident underscores that physical attacks remain a viable threat, especially when devices pass through third-party distributors.

Speculation has arisen about how the implant entered the supply chain. Binance co-founder Changpeng Zhao suggested on social media that attackers may have acquired the reseller and imposed a non-disclosure agreement, though no independent verification exists. CryptoBilis has not commented on the allegations.

Why it matters

Hardware wallets are a cornerstone of self-custody for millions of crypto holders. Evidence of tampering erodes confidence in the ecosystem’s most trusted storage method and highlights the need for rigorous distribution safeguards. As the industry continues to shift assets away from centralized exchanges, ensuring the integrity of physical key-management devices becomes essential for protecting user funds and maintaining broader market stability.