Ledger has confirmed that a hardware wallet sold through Southeast Asian reseller CryptoBilis contained an unauthorized hardware implant, validating user reports of drained wallets and missing funds.
Blockchain investigators estimate losses exceeding $86 million, with some analyses placing the figure closer to $93.2 million across 315 wallets and five blockchain networks.
The incident, which surfaced on October 9, has raised urgent concerns about supply‑chain security, reseller oversight, and the integrity of hardware wallets relied upon by millions of crypto users worldwide.
Tampered Hardware in CryptoBilis‑Linked Device
Ledger publicly confirmed on October 11 that one device sold through CryptoBilis contained an unauthorized hardware implant.
The reseller, which operates in Indonesia, Malaysia, and the Philippines, was immediately identified as the source of all confirmed cases. Ledger emphasized that its own direct sales channels and internal systems remain unaffected, indicating that the compromise occurred outside its manufacturing and distribution pipeline.
The company stated that the number of affected devices remains limited, though investigations are ongoing. Ledger has begun contacting impacted users and coordinating with authorities to determine the full scope of the incident. CryptoBilis has halted all hardware‑wallet sales pending further review.
The confirmation of a physical hardware implant marks a rare but serious breach of supply‑chain integrity.
Hardware wallets are designed to isolate private keys from internet‑connected environments, but that protection depends entirely on the authenticity of the device. When tampered hardware is introduced before a customer receives the wallet, the entire security model collapses.
How the Incident Was Discovered
Reports of missing cryptocurrency began circulating on October 9, when users noticed funds disappearing from wallets associated with devices purchased through CryptoBilis.
On‑chain analysts traced the stolen funds across Bitcoin, Ethereum, TRON, BNB Chain, and Polygon, identifying inflows to theft‑linked addresses from hundreds of victim wallets.
Bitquery’s blockchain analysis estimated that approximately $93.2 million was taken from 315 wallets, exceeding earlier reports of losses above $86 million. The stolen funds moved through multiple addresses after the initial thefts, suggesting a coordinated and multi‑stage laundering process.
Ledger has not confirmed the total amount stolen, noting that investigations are still underway. However, the consistency of user reports and the on‑chain evidence strongly indicate a large‑scale supply‑chain compromise affecting devices distributed through a single reseller.
Ledger’s Response and Strengthened Controls
Ledger has begun reviewing its reseller program and strengthening hardware‑security measures to prevent similar incidents. The company stated that its direct sales channels remain secure and that the compromise occurred outside its controlled distribution network.
CryptoBilis has suspended all wallet sales while cooperating with investigators. Ledger is working with authorities across multiple jurisdictions to identify the source of the tampered hardware, determine how many devices were affected, and trace the flow of stolen funds.
The company has also increased communication with users, advising anyone who purchased a Ledger device from CryptoBilis to stop using it immediately and migrate funds to a verified, genuine device.
Ledger reiterated that only devices purchased directly from Ledger or authorized partners should be considered safe.
Ongoing Investigations
Investigations into the CryptoBilis case are ongoing. Ledger is working with authorities to determine how the tampered devices entered the reseller’s inventory and whether additional units remain in circulation.
The company has not disclosed how many devices were affected, but early indications suggest the number is limited.
Blockchain‑analysis firms will continue monitoring theft‑linked addresses for movement of stolen funds. If attackers attempt to cash out through centralized exchanges, law‑enforcement agencies may intervene.
The incident is likely to accelerate industry‑wide efforts to strengthen supply‑chain security. Hardware‑wallet manufacturers may introduce new verification mechanisms, tighter reseller controls, and enhanced packaging safeguards to prevent tampering.
To users: hardware‑wallet security begins long before a device is powered on. Authenticity, provenance, and trusted distribution channels are now as important as the cryptographic protections inside the device.
