TechTrending
Ledger confirmed an unauthorized hardware implant in a device sold by reseller CryptoBilis. On-chain researchers estimate losses between $86 million and $93 million, though Ledger has not confirmed an official loss figure.
Ledger, a French cryptocurrency hardware wallet manufacturer, has confirmed that at least one device sold by the Southeast Asian reseller CryptoBilis contained an unauthorized hardware implant. The confirmation follows reports of significant fund losses among users who purchased devices through this specific reseller.
The incident came to light on Oct. 9, 2026, when Ledger announced it was investigating reports of missing funds from customers in Southeast Asia who bought products from CryptoBilis. The announcement followed claims by on-chain sleuth Specter, who stated that users were reporting wallet draining incidents on social media platforms.
Specter claimed to have identified inflows from hundreds of victim wallets across several blockchains, including Ethereum, TRON, and Bitcoin. According to Specter, total losses stand at more than $86 million. CoinDesk reported that third-party on-chain researchers have estimated the loss at between $86 million and $93 million from more than 300 wallets.
Ledger has not confirmed an official loss figure. However, the company acknowledged the investigation into the incident. In a statement released on Oct. 10, Ledger Support stated, "Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant." The company added that it is actively contacting affected users as part of an ongoing investigation.
Ledger stated that all confirmed cases identified so far involve products distributed through CryptoBilis, which operates in Indonesia, Malaysia, and the Philippines. The company emphasized that its internal systems, infrastructure, and services were not compromised. "To date, all confirmed cases related to the disclosed draining incident of Oct 9th, 2026, involve devices sold through the Southeast Asia reseller CryptoBilis," the company stated in an Oct. 11 update.
Ledger confirmed to TheStreet Roundtable that the incident is isolated specifically to CryptoBilis in the South East Asia market based on information available at the time. No reports were made of products purchased directly from Ledger.
Ledger has instructed users who purchased from CryptoBilis in the last 90 days to take immediate action. The company advised users not to initiate setup if they have not done so, or to move their assets to a new Ledger signer with a new recovery phrase if they have already set up their devices. Ledger also warned that scammers often attempt to exploit incidents of this type, reminding users that the company will never call, DM, or ask for their 24-word recovery phrase.
CryptoBilis has suspended sales of all hardware wallet inventory until the investigation concludes. Ledger stated it is cooperating with relevant authorities and reviewing authorized reseller controls.
The incident has raised broader questions about hardware wallet safety. In July 2026, a flaw in Coldcard’s seed-generation firmware allowed attackers to drain an estimated $100 million to $130 million in bitcoin, according to data from on-chain researchers. Ledger said in its Oct. 11 post, "Security isn’t static and this incident underscores why we continuously review and strengthen our distribution and anti-tamper processes."
Speculation regarding how the supply chain was breached continues to circulate. In a post on X, Binance co-founder Changpeng Zhao (CZ) alleged that the attackers "apparently bought the reseller and made them sign a non-disclosure agreement to keep their mouth shut." These claims have not been independently verified. CryptoBilis did not immediately respond to requests for comment regarding the incident or Zhao's specific allegations.
The confirmation of a physical hardware implant marks the first concrete evidence supporting earlier speculation of supply-chain tampering in the cryptocurrency sector. While Ledger maintains that the breach is isolated to a specific reseller and its own infrastructure remains secure, the incident highlights the vulnerabilities in the distribution chain for self-custody hardware. Users are urged to verify the source of their hardware wallets and remain vigilant against social engineering attacks that often follow such security breaches.
Sources
This article was drafted with AI assistance and checked against the sources above. Company claims are reported as claims. Cover image is AI-generated.
The day's checked news, by email
One short email a day with the top stories. Free, and you can unsubscribe in one click.
Or follow for the latest news:
TechSponsored
Hutton Aerographics lists drone services in Kamloops, the BC Interior, and the Lower Mainland, including real estate photography, construction monitoring, and surveying.
Leaked factory notices suggest Nvidia has stopped manufacturing the GeForce RTX 5090, including Chinese variants, to redirect GB202 chips to higher-margin professional and AI cards.
