Cryptocurrency wallet manufacturer Ledger has confirmed that a device linked to recent user fund losses contained an unauthorized hardware implant. According to the company, all confirmed cases identified so far involve products distributed through the Southeast Asian reseller CryptoBilis, which operates in Indonesia, Malaysia, and the Philippines.
In statements released on October 10 and 11, Ledger said it is actively contacting affected users and that CryptoBilis has suspended sales of all hardware wallet inventory pending investigation. The company emphasized that its internal systems and direct sales channels remain unaffected.
On-chain researchers have estimated losses between $86 million and $93 million from more than 300 wallets across multiple blockchains, including Bitcoin, Ethereum, and Tron. Ledger stated it has not independently confirmed an official loss figure.
Security Guidance and Response
Ledger advised customers who purchased devices through CryptoBilis not to initialize unused devices. Those with active wallets should move their funds to a new seed on a device obtained directly from Ledger.
The company is cooperating with relevant authorities and has reminded its network of distributors to source products exclusively through authorized channels, strictly prohibiting the restocking of returned products. Ledger also cautioned users against scammers attempting to exploit the incident, reiterating that the company will never request recovery phrases via calls or direct messages.
Broader Industry Context
The incident has raised questions about hardware wallet security across the industry. Following the 2022 collapse of FTX exchange, many investors moved assets into self-custody using physical hardware wallets to keep private keys offline.
In July 2026, a flaw in Coldcard's seed-generation firmware was reported to have resulted in an estimated $100 million to $130 million in bitcoin losses, according to on-chain researchers.
Ledger stated that the physical tampering in this case is isolated to the batch distributed by CryptoBilis and said it is reviewing authorized reseller controls, advancing hardware protections, and calling for broader industry improvements in chain-of-custody practices.
