- Published on
Ledger says unauthorized implant found in at least one device sold by CryptoBilis
- Authors
- Name
- DeepHorus
Ledger has confirmed that a hardware wallet tied to recent crypto thefts contained an unauthorized hardware implant. All confirmed cases involve devices sold through CryptoBilis, a Southeast Asian reseller operating in Indonesia, Malaysia, and the Philippines. The finding is the first concrete evidence of supply-chain tampering in the incident.
In an Oct. 10 statement, Ledger Support said one impacted user’s device held an unauthorized implant. The company is contacting affected users, and CryptoBilis has suspended sales of all hardware wallet inventory. An Oct. 11 update said impacted devices appear limited.
The incident emerged after Ledger probed missing funds from CryptoBilis customers. On-chain researchers estimate $86 million to $93 million was stolen from more than 300 wallets across Bitcoin, Ethereum, and Tron. Ledger has not confirmed an official loss.
Ledger said its internal systems and direct sales channels were not compromised. It is cooperating with authorities and reminded distributors to source only through authorized channels. The company also repeated guidance: do not initialize unused devices; move funds to a new seed on a Ledger-direct device.
Affected users were urged to contact official Ledger Support and file complaints with local law enforcement. Ledger warned that scammers may exploit the incident. The case has renewed broader questions about hardware wallet safety, especially after FTX’s 2022 collapse pushed many investors into self-custody.
Physical storage has not been immune. In July 2026, a Coldcard firmware flaw let attackers drain an estimated $100 million to $130 million in bitcoin. The CryptoBilis investigation remains ongoing, and the full scope is unclear. The outcome could shape how hardware wallet makers secure supply chains.
