Ledger Confirms Hardware Implant in CryptoBilis-Sold Wallets; $86M–$93M Stolen

Ledger has confirmed the presence of an unauthorized hardware implant in at least one cryptocurrency wallet sold through Southeast Asian reseller CryptoBilis, following reports of large-scale fund thefts in early October 2026. The company stated on October 10 that it discovered the implant during an investigation into reported cryptocurrency losses affecting customers in Indonesia, Malaysia, and the Philippines. According to reports, the implant—described as a small circuit board positioned beneath the device screen—may have intercepted sensitive information including recovery phrases displayed during initial setup, potentially transmitting this data back to attackers via an embedded SIM card.

On-chain researchers have estimated total losses between $86 million and $93 million across more than 300 wallets on multiple blockchains including Bitcoin, Ethereum, and Tron. Ledger has not independently confirmed these figures. The company advised customers who purchased devices through CryptoBilis in the preceding 90 days not to initialize unused devices, and recommended those with active wallets transfer funds to new recovery phrases on devices obtained directly from Ledger. CryptoBilis suspended all hardware wallet sales as a precaution while the investigation continues.

Ledger stated that all confirmed cases of tampering involve devices sold through CryptoBilis and that the number of affected devices appears limited. The company emphasized that its internal security infrastructure, systems, and services have not been compromised, and that wallets purchased directly from Ledger's official channels remain unaffected. Security researcher Mark Karpelès reported finding suspicious electronics behind a Ledger Nano X screen in Malaysia. Ledger is actively contacting affected users and working with authorities; the company also advised distributors and resellers to source products exclusively through authorized channels and prohibited the restocking of returned items.

The incident marks a significant supply chain attack within the hardware wallet sector. Ledger warned users against phishing attempts and scams that exploit such incidents, reiterating that the company will never request recovery phrases or PINs. The discovery provides direct evidence of physical device tampering, a vulnerability that has raised broader industry questions about hardware wallet security following similar incidents affecting other manufacturers.