What Ledger Confirmed
Ledger has confirmed that at least one device tied to recent user fund losses contained an unauthorized hardware implant. The company said all confirmed cases so far involve products sold through CryptoBilis, a reseller in Southeast Asia. CryptoBilis operates in Indonesia, Malaysia, and the Philippines. In an Oct. 10 statement, Ledger Support said it could confirm one impacted user’s device had an unauthorized implant. The company is contacting affected users while investigating. CryptoBilis has suspended sales of all hardware wallet inventory until the probe ends.
Losses and Supply-Chain Questions
The confirmation is the first concrete evidence of supply-chain tampering, which had been speculation before. The incident surfaced Friday when Ledger said it was looking into reports of missing funds from customers who bought devices through CryptoBilis. Ledger has not confirmed an official loss figure. Third-party on-chain researchers estimate between $86 million and $93 million was taken from more than 300 wallets across Bitcoin, Ethereum, and Tron. Ledger says there is no indication its own internal security infrastructure, systems, or services were compromised. On Oct. 11, Ledger said impacted device volume appears limited and that direct sales channels remain unaffected. The company is cooperating with authorities. It also told distributors to source only through authorized channels and not restock returned products.
What Users Should Do
For customers who bought devices via CryptoBilis, Ledger repeated its guidance: do not initialize unused devices. If a device is already set up, move funds to a new seed on a Ledger device from an authorized source. Users should contact official Ledger Support and file complaints with local law enforcement. Ledger warned that scammers often exploit these incidents. It said it will never call, DM, or ask for a 24-word recovery phrase. That warning matters because panic can lead people to share seed words with fake support accounts.
Hardware Wallet Safety Debate
The case has renewed questions about hardware wallet safety. After the 2022 collapse of FTX, many investors moved assets into self-custody and relied on physical wallets from Ledger, Coinkite, and others. The appeal is simple: keep private keys offline. But supply chains can introduce risks that firmware and software alone may not catch. Ledger’s investigation is ongoing, and the full scope of the tampering is not yet clear. For now, the company’s direct channels and internal systems appear unaffected, according to Ledger. Still, buyers from third-party resellers should verify where their device came from and treat unopened devices with care.
