Ledger It has been confirmed that there is unauthorized hardware implantation in a device related to recent cryptocurrency thefts. The company stated that all the confirmed cases so far involve wallets sold by a Southeast Asian reseller, CryptoBilis.
Online researchers estimate that over 300 wallets had $86 million to $93 million stolen from them, however, Ledger indicates that their internal systems and direct sales channels were not compromised.
Ledger It is recommended that CryptoBilis customers do not initialize unused devices. For users who have already enabled their wallets, it is advised to migrate their funds to a new device obtained directly from Ledger and to use new mnemonic phrases.
Ledger This cryptocurrency wallet manufacturer has confirmed that a device related to recent user fund losses contained unauthorized hardware implants. The company stated that all confirmed cases to date involve products distributed through a Southeast Asian reseller, CryptoBilis.
In a statement released on October 10, Ledger Support stated: "It can be confirmed that one of the affected users' devices contained unauthorized hardware implants." The company also added that they are actively contacting the affected users as part of the ongoing investigation; CryptoBilis has suspended the sale of all hardware wallet inventory until the investigation is completed.
This confirmation of physical implantation means that previous speculations about supply chain tampering have for the first time been supported by concrete evidence.
This incident was first exposed on Friday, when Ledger acknowledged that they were investigating reports of missing funds from customers who purchased devices through CryptoBilis. CryptoBilis operates in Indonesia, Malaysia, and the Philippines.
Although Ledger has not yet confirmed the official amount of losses, third-party researchers on the blockchain estimate that the losses across multiple blockchains range from 86 million to 93 million US dollars, involving more than 300 wallets, including Bitcoin, Ethereum, and Tron. The company reiterates that there is no indication that its internal security infrastructure, systems, or services have been compromised.
Ledger indicates that cooperation has been established with the relevant authorities on Sunday. The company also reminds its distribution network that products must only be purchased through authorized channels, and the reselling or return of products is strictly prohibited.
The company reiterated its previous safety advice for customers who purchased devices through CryptoBilis: "Do not initialize unused devices. If they have already been set up, please migrate the seeds to a new device from Ledger." The company urges affected users to contact the official Ledger Support and report the issue to local law enforcement authorities.
Ledger also warns that scammers often attempt to take advantage of such incidents to remind users that the company will never call, send private messages, or request their 24-word recovery phrase.
Can wallets really SAFU?
Ledger This incident has once again sparked broader discussions in the industry about the security of hardware wallets. After the collapse of the exchange on FTX in 2022, millions of investors shifted their assets to self-hosted solutions, relying heavily on physical hardware wallets produced by companies such as Ledger and Coinkite (the manufacturers of Coldcard), in order to keep their private keys completely offline.
However, the reality is that physical storage is not without vulnerabilities.
In July 2026, a flaw in the mnemonic phrase generation firmware of Coldcard allowed attackers to transfer an estimated amount of 100 million to 130 million US dollars in Bitcoin, according to data from on-chain researchers.
In this latest attack, Ledger asserts that the physical tampering was strictly limited to the batch of products distributed by CryptoBilis, and that necessary measures are being taken to avoid such risks.
In a post on October 11th, Ledger stated: "Security is not static; this incident highlights why we need to continuously review and strengthen our distribution and anti-tampering processes."
The company added that it is reviewing control measures for authorized resellers, advancing hardware protection, and calling on the industry to make broader improvements in delivery chain management practices.
Nevertheless, speculations about how the supply chain was actually breached continue to circulate.
Zhao Changpeng ( CZ ), co-founder of Binance, posted on X stating that the attackers "obviously bought resellers and made them sign non-disclosure agreements to keep silent."
These claims have not yet been independently verified. CryptoBilis did not immediately respond to requests for comments on this incident and the specific allegations against Zhao Changpeng.
