Ledger Confirms Hardware Implant in CryptoBilis Wallet as Losses Near $93M

Author: Crypffalo Research · 15:55 12/10/2026

Ledger found an unauthorized hardware implant in a victim's device; all confirmed cases involve wallets sold by Southeast Asian reseller CryptoBilis, with losses estimated at $86M–$93M across about 311 wallets.

Ledger Confirms Hardware Implant in CryptoBilis Wallet as Losses Near $93M

Ledger has confirmed that an unauthorized hardware implant was found inside a device belonging to a user who lost funds, and says every confirmed case so far involves wallets sold through CryptoBilis, a reseller operating in Indonesia, Malaysia and the Philippines. Independent on-chain researchers estimate losses of roughly $86 million to $93 million across about 311 wallets. That marks a sharp escalation from Oct 9, when Ledger said only that it was investigating.

Key takeaways

Ledger confirmed an unauthorized implant in at least one victim's device; it has not disclosed how the attack works.
All confirmed cases trace back to CryptoBilis, which has halted sales of its entire hardware wallet inventory pending the investigation.
Third-party loss estimates: more than $86 million, with Bitquery putting the figure near $92.9 million across 311 wallets on five chains. Ledger has not published an official total.
Ledger says it has no indication that its security infrastructure, systems or direct sales channels were compromised.
A separate report of a possibly tampered device bought in Europe is circulating but has not been confirmed by Ledger.

From suspicion to a confirmed hardware tamper

On Oct 9, Ledger first acknowledged it was looking into reports of missing funds from customers who bought devices through CryptoBilis. In a Saturday evening update on Oct 10, the company said it had examined a device from an affected user and found an "unauthorized hardware implant." On Oct 11, it added that all confirmed cases tied to the incident involved CryptoBilis-sold devices, and that it was working with authorities and the SEAL 911 security response group.

The physical-tampering theory gained traction after former Mt. Gox chief Mark Karpelès shared images of a Ledger he said he bought in Malaysia, showing a small component hidden beneath the screen area. Ledger has so far confirmed the implant in one device and has not said whether it explains every reported drain.

Timeline of the Ledger CryptoBilis incident, Oct 9 to Oct 12

Losses and where the money went

Early tallies put losses above $86 million. A newer Bitquery report raised the estimate to about $92.9 million across 311 wallets on five blockchains, including Bitcoin, Ethereum and Tron. According to KuCoin's daily market report, about 2,990 ETH (around $7.45 million) was routed through Tornado Cash and then swapped into ZEC via NEAR Intents, a sign the attacker is working to obscure the trail. All of these figures come from third parties and have not been confirmed by Ledger.

CryptoBilis has suspended sales of all hardware wallets, not just Ledger products, until the probe concludes. Ledger has told distributors to source inventory only through authorized channels and banned the restocking of returned units. Binance co-founder Changpeng Zhao suggested the incident looks like a supply-chain attack on a single vendor and speculated that the attackers may have bought the reseller outright — claims that remain unverified.

What Ledger is telling users

If you bought a device through CryptoBilis in the 90 days before the warning and have not set it up: do not initialize it.
If you already use it: consider moving assets to a device bought directly from Ledger with a brand-new recovery phrase.
Use only official channels such as support.ledger.com. Ledger will never call, DM or ask for your 24-word recovery phrase, and scammers often exploit incidents like this with fake "recovery" offers.

More broadly, hardware wallets bought from unofficial sellers, grey-market importers or as opened-box units carry similar risks.

What it means for crypto markets

Price impact has been minimal so far. Bitcoin traded around $84,000 on Monday as oil prices eased and ETF selling slowed. Losses of $86 million to $93 million are significant for the victims but small relative to overall market liquidity.

The bigger issue is trust in hardware wallets, long seen as the safest option for self-custody. In the constructive scenario, Ledger contains the incident to a single reseller, discloses the attack method and rolls out stronger anti-tamper checks, pushing the industry to tighten chain-of-custody standards. The risk scenario: if reports from other markets such as Europe are confirmed, pressure on Ledger and on self-custody sentiment would rise, and impersonation scams would likely intensify. In July, a flaw in Coldcard's seed-generation firmware was blamed for an estimated $100 million to $130 million in bitcoin losses, a reminder that hardware wallet incidents have become a recurring theme this year.

What to watch next

Whether Ledger discloses how the implant works and publishes an official loss figure.
The outcome of checks on the device reportedly bought in Europe.
Movements from the attacker's wallets, especially further transfers through mixers.
Beyond this story, markets are waiting for U.S. CPI on Oct 14; see the economic calendar and real-time liquidations.

Frequently Asked Questions

Are Ledger wallets bought directly from Ledger affected?

According to Ledger, every confirmed case so far involves CryptoBilis-sold devices, and it has seen no sign that its direct sales channels or systems were compromised.

How can I tell if my hardware wallet has been tampered with?

Most users cannot spot an implant by eye. The safer approach is to check where you bought it; if it came from an unofficial seller, consider moving funds to a genuine device with a new recovery phrase and contact official support.

Will Ledger ask for my 24-word recovery phrase to help recover funds?

No. Ledger never asks for your recovery phrase, and anyone who does is running a scam.

*This content is for information only and is not financial advice.*

Tags: Ledger, Security, Hardware Wallet, Hack

Crypffalo: Crypto news & data