Ledger Confirms Unauthorized Hardware Implant in Crypto Wallet Sold by CryptoBilis

Ledger has confirmed that a cryptocurrency hardware wallet linked to reported fund losses contained an unauthorized hardware implant, bringing physical tampering into its investigation of devices sold through Southeast Asian reseller CryptoBilis.

The finding raises supply chain security concerns, but Ledger has not confirmed how the implant worked or whether it caused every reported theft.

In an October 10 statement, Ledger Support said, “Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant.” CryptoBilis has stopped selling all hardware wallets while the investigation continues, and Ledger is contacting affected customers.

The company’s October 11 update said all confirmed cases connected to the October 9 draining incident involved devices sold through CryptoBilis. Ledger described the number of affected devices as limited and said its own systems and direct sales channels remained unaffected. It is also working with relevant authorities.

72 hour update on reseller CryptoBilis incident 🔽

As the investigation continues, we are working with relevant authorities. The volume of impacted devices is limited. We know this is concerning, especially for those directly affected, and we are reaching out to impacted users.…

— Ledger (@Ledger) October 11, 2026

The investigation began after customers reported missing cryptocurrency from wallets associated with devices purchased through CryptoBilis, which serves Indonesia, Malaysia, and the Philippines.

Blockchain investigator Specter estimated possible losses above $86 million across Bitcoin, Ethereum, and Tron. That figure has not been independently confirmed, and Ledger has not established a final loss total.

Hardware Implant Raises Supply Chain Concerns

Hardware wallets normally keep private keys offline, reducing exposure to malware on connected computers. A physical implant creates a different risk because an added component could target information displayed during setup rather than attack the wallet’s core security system.

Security researcher Mark Karpelès described suspected implants that monitor the wallet screen and send the recovery phrase through a cellular connection. Reported components include a small circuit board, a microcontroller, an antenna, an LTE chip, and an eSIM. These findings remain researcher observations, not a complete technical explanation confirmed by Ledger.

A recovery phrase allows someone to restore a wallet and control its funds. If an attacker captures that phrase during setup, they may not need continued access to the original device. Earlier reporting on fake Ledger apps targeting macOS users shows how criminals also seek these secrets through software tricks. PoisonSeed phishing campaigns have similarly used false wallet upgrade pages to collect recovery phrases.

A separate post by Johannes claimed a modified device had been bought from an official reseller in Europe. The account said that wallet had not lost funds. This claim has not been confirmed by Ledger and should not be treated as proof that the confirmed CryptoBilis incident extends beyond its stated scope.

Ledger advises CryptoBilis buyers not to initialize unused devices. Customers who already completed setup should move assets to a new device purchased from Ledger and use a newly generated recovery phrase. Reusing the old phrase would not address the risk of that phrase already being exposed.

Affected users should contact official Ledger Support and report suspected theft to local law enforcement. Ledger also warned that scammers may exploit the incident and said it will never call, send direct messages, or request a customer’s 24-word recovery phrase.

The company is reviewing reseller controls and hardware protections. It has reminded distributors to buy only through authorized channels and never restock returned products. The investigation still needs to establish where tampering occurred, how many devices were modified, and which losses are directly connected to the confirmed implant. Ledger has not publicly identified who installed the unauthorized hardware component.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup into your SOC