Ledger, a leading manufacturer of hardware wallets, has identified an unauthorized hardware implant in one of its devices, intensifying concerns over the security of third-party resold wallets. The discovery follows extensive losses exceeding $86 million across Bitcoin, Ethereum, and Tron wallets, reportedly connected to compromised wallets purchased via a Southeast Asian reseller known as CryptoBilis.
Ongoing investigation and user outreach
On Sunday, Ledger posted an update on X confirming its investigation into the compromised devices. The company stated it has begun reaching out to affected users in cooperation with relevant authorities and continues to gather information.
One blockchain analyst estimated the total loss from all impacted wallets at over $86 million. However, Ledger has not yet confirmed the exact number of affected customers.
Ledger has verified that an unauthorized device component was found in a user’s hardware wallet, purchased through a third-party reseller in Southeast Asia. The company is directly contacting victims as part of its ongoing investigation.
Ledger has called on anyone with information about the case to contact its bounty program, emphasizing the need for community assistance as the company works to determine the full scope and origin of the compromise.
Security concerns focus on third-party resellers
The incident sparked questions about the safety of buying hardware wallets from resellers, even those previously listed as authorized. CryptoBilis, which operated as an official reseller of Ledger products in Indonesia, Malaysia, and the Philippines, has since suspended all hardware wallet sales following the investigation’s launch.
Ledger reported ongoing discussions with CryptoBilis regarding next steps, but it remains unclear whether the issue is isolated or affects more devices from the reseller’s distribution.
The presence of the unauthorized implant raises the possibility of tampering at some point after manufacturing and before reaching the end user. Neither Ledger nor CryptoBilis has clarified how, when, or by whom the device was compromised.
Ledger asserted that its internal production processes and supply chains remain uncompromised, suggesting the event is limited to devices distributed through CryptoBilis.
Mini dictionary: CryptoBilis is a Southeast Asian company that acted as an authorized Ledger hardware wallet reseller in Indonesia, Malaysia, and the Philippines until sales were suspended in the wake of the implant incident.
Safety recommendations for CryptoBilis customers
Ledger has urged customers who purchased hardware wallets from CryptoBilis not to set up unused devices until the ongoing investigation provides further clarity. Those who already activated such devices are advised to move their funds to a new Ledger wallet using a fresh recovery seed, in line with established security protocols.
The company reiterated the importance of never disclosing recovery phrases and ensuring any new device comes from a trusted source to minimize risks.
The recent incident demonstrates that even wallets sourced through official channels can be compromised if the supply chain is not fully secure, underscoring the need for vigilance by all cryptocurrency holders.
Scale of losses and future steps
Investigators stated the estimated losses exceeded $86 million and affected holders of Bitcoin, Ethereum, and Tron. The figure was reported by blockchain expert Specter but remains unverified by Ledger.
| Asset | Estimated Loss | Source of Compromise |
|---|---|---|
| Bitcoin | Included in $86 million total | Implanted Ledger device |
| Ethereum | Included in $86 million total | Implanted Ledger device |
| Tron | Included in $86 million total | Implanted Ledger device |
Authorities have not disclosed the final number of impacted customers or whether the situation extends beyond devices distributed by CryptoBilis. The investigation continues as Ledger and CryptoBilis work toward clarifying timelines, sources of tampering, and possible remediation.
