Ledger Finds Unauthorized Hardware Implant in CryptoBilis-Sold Wallet Amid Fund Theft Reports
Ledger found a hardware implant in a CryptoBilis-sold wallet after reports of more than $86 million in stolen crypto.
Ledger paused sales through reseller CryptoBilis after Southeast Asian users reported stolen cryptocurrency totaling more than $86 million, according to investigator Specter. Ledger said one affected device contained an unauthorized hardware implant and that all confirmed cases involve CryptoBilis-sold devices. Buyers from the last 90 days were told not to set up unused devices and to move assets to a new signer with a new seed if already set up. CryptoBilis halted hardware-wallet sales and warned that a pre-printed recovery phrase means the wallet should be treated as unsafe.
- Losses linked to CryptoBilis-sold Ledger devices exceed $86 million.
- Ledger found an unauthorized hardware implant in one device.
- Confirmed cases are limited to CryptoBilis-sold hardware.
- Users should avoid setup or migrate assets to a new seed.
- A pre-printed recovery phrase means the wallet is unsafe.
Full article384 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananOct 12, 2026Cryptocurrency / Cybercrime
Cryptocurrency hardware maker Ledger has temporarily paused sales of its products via CryptoBilis following reports of stolen funds linked to devices sold by the reseller.
On Friday, the company said it was investigating reports of loss of funds from users in Southeast Asia who had purchased products from CryptoBilis. The incident is said to have resulted in losses totaling more than $86 million, according to pseudonymous blockchain investigator Specter.
"We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up if you have not done so yet," Ledger said in an X post. "If you have set up your Ledger device, consider moving assets to a new Ledger signer (with new seed)."
The company has since revealed that one of the impacted users' devices contained an unauthorized hardware implant, and that it's reaching out to impacted users as part of an ongoing probe into the incident. Out of an abundance of caution, CryptoBilis has ceased sales of all hardware wallet inventory until the investigation is concluded.
"Your recovery phrase must be generated by your device when you set it up, and written down by you," CryptoBilis said in an alert on its website. "If your device came with a recovery phrase already printed or written on a card or sheet, or if anyone other than you has seen your recovery phrase, treat your wallet as unsafe."
"Never share your recovery phrase or PIN with anyone. No one from CryptoBilis or Ledger will ever ask for them. Be careful of anyone who offers to recover lost funds; these offers are almost always scams."
In a follow-up update posted on October 11, 2026, Ledger acknowledged that the CryptoBilis incident has impacted a "limited" number of devices, adding all confirmed cases involve devices sold through CryptoBilis.
The company also advised resellers and distributors to source products only through authorized channels and never to restock returned products.
"Also, we strongly advise users not to purchase from unauthorized resellers, where the risk of buying suspicious, counterfeit or modified devices is important as nothing operates under ledger security guidelines," it added.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.