Hardware wallet manufacturer Ledger has issued an urgent warning to customers who recently purchased devices from CryptoBilis, a Southeast Asian reseller operating in Indonesia, Malaysia, and the Philippines. Users who still have uninitialized devices in the box are instructed not to set them up, while those who have already configured their devices are advised to immediately transfer their assets to a new Ledger hardware wallet using a brand-new recovery phrase.
The advisory follows ongoing on-chain investigations that estimate total losses ranging from $86 million to $93 million across hundreds of wallets spanning multiple networks, including Bitcoin, Ethereum, and TRON.
Unauthorized Hardware Implant Discovered
On October 9, 2026, Ledger ordered CryptoBilis to halt all sales and shipments following reports of drained user funds. The following day, Ledger confirmed that at least one affected device contained an unauthorized hardware implant, and that every verified draining case traced back to a purchase from CryptoBilis.
According to the company, the tampering involved an LTE-enabled microcontroller equipped with eSIM functionality capable of capturing a user's recovery phrase during the setup process without compromising the device's secure element.
Reseller Review and Next Steps
CryptoBilis has suspended all sales activity while investigations continue. The incident follows a change in ownership at the reseller in March 2026. In response, Ledger stated that it is actively reviewing its reseller protocols and anti-tampering measures, emphasizing that its direct sales channels and infrastructure remain unaffected.
Ledger is currently cooperating with law enforcement and received assistance from security incident response group SEAL 911. The company's guidance specifically targets customers who purchased a device from CryptoBilis within a 90-day window, advising them to bypass firmware updates or PIN changes and instead migrate funds entirely to a newly generated wallet.
