Ledger Says Unauthorized Implant Found in at Least One Device Sold by CryptoBilis

Ledger confirmed an unauthorized hardware implant in a device linked to CryptoBilis, a Southeast Asian vendor, that is to the detriment of digital currencies. The company says the confirmed cases are limited and its internal systems remain unaffected.

Crypto wallet maker Ledger has confirmed that a device linked to a user's recent financial losses contained an unauthorized hardware implant. According to the company, all confirmed cases identified so far involve products distributed through Southeast Asian vendor CryptoBilis.

In a statement released on October 10, Ledger Support stated, "Ledger can confirm that one of the affected users' devices contained an unauthorized hardware implant." The company added that it is actively contacting affected users as part of the ongoing investigation, and that CryptoBilis has suspended the sale of all hardware wallet inventory pending the investigation.

In a subsequent update on October 11, Ledger noted that the volume of affected devices appeared to be limited. The company said that its internal systems and direct sales channels were not affected.

Confirmation of a physical implant represents the first concrete evidence to support earlier speculation about supply chain manipulation.

The incident first came to light on Friday, when Ledger confirmed it was investigating reports of missing funds from customers who purchased devices through CryptoBilis, which operates in Indonesia, Malaysia and the Philippines.

While the ledger has not confirmed the official loss, third-party blockchain researchers have estimated the loss at between $86 million and $93 million from more than 300 wallets across multiple blockchains, including Bitcoin, Ethereum, and Tron. The company reiterated that there was no indication that its internal security infrastructure, systems or services had been compromised.

Ledger announced on Sunday that he will cooperate with the relevant authorities. The company also reminded its distributor network to procure products exclusively through authorized sourcing channels and strictly prohibited restocking of returned goods.

The company reiterated its previous security instructions to customers who purchased devices through CryptoBilis: “Do not initialize unused devices. If you're already set up, switch to a new version of the Ledger device." The company urged affected users to contact Ledger's official support and file complaints with local law enforcement.

Ledger also warned that scammers often try to exploit incidents like this by reminding users that the company will never call, DM or ask for their 24-word recovery phrase.

The Ledger incident has again raised broader questions in the industry about the safety of hardware wallets. After the collapse of the FTX exchange in 2022, millions of investors moved their assets, relying heavily on physical hardware wallets made by companies like Ledger and Coinkite (makers of Coldcard) to hold private keys completely offline.

But in practice, physical storage has not been immune from vulnerabilities.

In July 2026, a flaw in Coldcard, an early-generation firmware, allowed attackers to drain around $100-130 million in Bitcoins, according to data from chain researchers.

In this current exploit, Ledger believes that physical manipulation is strictly isolated in the batch distributed by CryptoBilis and takes the necessary measures to prevent such risks.

"Security is not static, and this incident demonstrates why we continually review and strengthen our distribution and anti-tampering processes," Ledger said in its Oct. 11 post.

The company added that it is reviewing reseller authorization controls, upgrading hardware protections and calling for broader industry improvements in supply chain practices.

However, speculation continues about how the supply chain will break down.

Binance co-founder Changpeng Zhao (CZ) claimed in a post on X that the attackers "apparently bought the seller and forced them to sign a non-disclosure agreement to keep their mouths shut."

These claims have not been independently verified. CryptoBilis did not immediately respond to requests for comment on the incident or Zhao's specific claims.

Diversified RWA stablecoins maintain a 5-7% return on real credit as crypto funding drops to 4%. GENIUS increases performance off-chain. TAM increases to $4 billion in 3 years.