Ledger announced on Sunday that it is investigating a series of fund losses reported by customers in Southeast Asia. The victims bought hardware wallets from CryptoBilis, a vendor based in Kuala Lumpur, Malaysia. One of the devices returned by a user was found to contain an unauthorised hardware component that could expose private keys.
Scope and financial impact
The company has not disclosed the total amount lost, but blockchain researcher Specter calculated that approximately $86 million has been extracted from compromised wallets. It is unclear how many of the devices sold by CryptoBilis were affected, and Ledger has described the number of impacted products as limited.
Ledger’s response
Ledger has reached out to customers who purchased wallets from the reseller and advised them not to initialise the devices. The vendor has since halted sales of Ledger products. Ledger also stated that it is working with law-enforcement agencies and is reviewing its distribution and anti-tamper procedures to prevent future incidents. The firm reiterated its recommendation that users acquire hardware wallets only through official channels.
Broader context of hardware-wallet threats
The episode follows a string of recent attacks on hardware wallet ecosystems. In July, a vulnerability in Coldcard devices allowed hackers to steal close to $120 million in Bitcoin by exploiting a firmware bug that generated weak seed phrases. Last month, Trezor disclosed that a third-party fulfilment partner suffered a data breach affecting roughly 81,000 customers. Additionally, scammers have used information obtained via Ledger’s payment processor Global-e to launch phishing campaigns.
Industry implications
The discovery of a physical implant underscores the importance of supply-chain security for crypto-related hardware. While software-based attacks receive most of the attention, this case demonstrates that tampering with the physical device can have equally devastating financial consequences. Manufacturers may need to tighten vetting of distributors and enhance anti-tamper detection mechanisms. Users are also reminded to verify the provenance of their wallets and to follow best-practice guidelines for device setup.
Why it matters
The incident highlights a tangible risk that extends beyond software vulnerabilities, reminding the community that hardware wallets are only as secure as the supply chain that delivers them. As crypto adoption grows, ensuring the integrity of physical devices becomes critical to safeguarding billions of dollars in digital assets.
