Ledger Confirms Hardware Implant in Reseller Device After Wallet Drains Near $90 Million
Hardware wallets are supposed to be the safe option, the place crypto holders move their coins when they don’t want to trust an exchange or a hot wallet. This weekend, that assumption took a hit. Ledger has confirmed that at least one device tied to a wave of wallet drains contained an unauthorized hardware implant, and that every confirmed case so far involves devices sold through a single third-party reseller in Southeast Asia, CryptoBilis.
Onchain researchers estimate that between $86 million and $93 million has been taken from more than 300 wallets across Bitcoin, Ethereum and Tron, according to CoinDesk. Ledger hasn’t confirmed an official loss figure.
How the incident unfolded
The problem surfaced on Friday, October 9, when onchain analyst Specter traced more than $86 million in losses from Ledger users across the three networks. Ledger said it was investigating reports of missing funds from customers who had bought devices through CryptoBilis and asked the reseller to stop selling and shipping Ledger products.
On Saturday, Ledger Support posted the key finding on X: “Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant.” CryptoBilis suspended sales of all its hardware wallet inventory until the investigation is complete.
By Sunday, Ledger said all confirmed cases connected to the October 9 draining incident were linked to devices sold through CryptoBilis. The company described the number of affected devices as limited, said its internal systems and direct sales channels were not affected, and said it was cooperating with the relevant authorities.
CryptoBilis is a Malaysia-based hardware wallet retailer that operates in Indonesia, Malaysia and the Philippines. It didn’t respond to CoinDesk’s requests for comment.
A physical attack, not a software bug
What makes this case unusual is where the compromise appears to sit. Rather than a flaw in Ledger’s firmware or a phishing scheme, the evidence so far points to extra hardware placed inside devices before they reached buyers.
Over the weekend, security firm Tibane Labs published a report confirming the implant and describing two variants, according to BleepingComputer. Former Mt. Gox chief executive Mark Karpelès also shared an image of an implant from a device he said was bought on a well-known platform from a Chinese seller and shipped from Malaysia. Karpelès didn’t name CryptoBilis.
BleepingComputer also noted a point that will worry hardware wallet owners: Ledger’s Genuine Check, the tool meant to confirm a device is authentic, can’t detect an added implant if the original Secure Element chip is left intact. In other words, a tampered device can pass the standard authenticity test.
Exactly how and when the devices were altered remains unclear. Binance co-founder Changpeng Zhao alleged on X that the attackers “apparently bought the reseller and made them sign a non-disclosure agreement.” That claim hasn’t been verified by Ledger, CryptoBilis or any independent investigator.
What Ledger is telling users
Ledger’s advice depends on whether a device has been set up. Anyone who bought a Ledger from CryptoBilis in the past 90 days and hasn’t initialized it shouldn’t do so. Anyone who has already set one up should move their funds to a new recovery phrase generated on a device bought directly from Ledger.
The company also asked affected users to contact official Ledger Support and file reports with local police, and repeated that it will never call, message or ask for a 24-word recovery phrase. That warning matters because high-profile incidents tend to bring a wave of fake “support” scams aimed at worried users.
Ledger has also reminded its distribution partners that they must source products only through authorized channels and must not restock returned items, a practice that could let a tampered unit re-enter the supply chain.
Why it matters for self-custody
For years, the standard security advice in crypto has been to buy a hardware wallet and keep the recovery phrase offline. This incident doesn’t undercut that advice, but it adds an important condition: where the device comes from matters as much as the device itself. A wallet bought at a discount from an unofficial seller, or a returned unit put back on a shelf, carries risks a buyer can’t easily check.
It also adds to a difficult year for self-custody hardware. CoinDesk noted that a seed-generation flaw affecting Coldcard devices in July 2026 reportedly let attackers drain an estimated $100 million to $130 million in bitcoin, according to onchain researchers.
According to BleepingComputer, Ledger hasn’t said whether any other resellers are affected, and there’s no indication of that so far. Still, trust in the wider reseller network has taken a knock, with some users calling for it to be scaled back. The open questions now are how many devices were tampered with, when the implants were added and whether any of the stolen funds can be traced and frozen. Ledger’s further findings, and any detail from CryptoBilis, will shape how far the damage spreads beyond the buyers already affected.