Ledger, the French hardware-wallet manufacturer, announced that a device obtained from the Southeast Asian reseller CryptoBilis contained a malicious hardware implant. The anomaly was identified during the company’s probe into a series of crypto-asset losses reported by users of that vendor’s inventory.
Scope and Estimated Losses
Independent analyst Specter has approximated that the total value at risk could be above $86 million, encompassing Bitcoin, Ethereum and Tron holdings. The precise number of affected customers has not been disclosed, and Ledger has not quantified the exact amount lost per user.
Response from Ledger and CryptoBilis
Following the discovery, Ledger issued a statement on X, confirming that its own infrastructure and services remain intact and that the breach appears confined to the single reseller’s supply chain. CryptoBilis, which had been listed as an authorized Ledger distributor in Indonesia, Malaysia and the Philippines, announced that it has suspended all hardware-wallet sales while the matter is investigated. The two parties are in ongoing dialogue to determine the next steps.
Advice to Affected Users
Ledger advises anyone who purchased a device from CryptoBilis and has not yet initialized it to refrain from doing so. Users who have already set up the wallet are urged to transfer their assets to a new Ledger device generated from a fresh seed phrase. The company also invites anyone with relevant information to contact its bounty programme via [email protected].
Investigation Status
The investigation remains active, with Ledger working closely with CryptoBilis and law-enforcement agencies. No indication has been given that the compromise extends beyond the specific reseller’s inventory, and the firm emphasizes that its core systems have not been breached.
Why it matters
The episode underscores the importance of supply-chain security for hardware wallets, which are widely regarded as a primary defense against crypto theft. A single compromised unit can jeopardise millions of dollars in user funds, eroding confidence in otherwise trusted custodial solutions. The incident also highlights the need for users to verify the provenance of their devices and to remain vigilant about potential hardware tampering, especially when purchasing from third-party sellers in regions with less regulatory oversight.
