Ledger Confirms Unauthorized Hardware Implant in Device Sold by Reseller CryptoBilis
Ledger confirms tampered device tied to fund losses
Ledger, the company that makes hardware wallets for storing crypto keys offline, has confirmed that at least one device connected to recent crypto thefts contained an unauthorized hardware implant. In a statement on Oct. 10, Ledger said it can confirm the implant in one impacted user's device and that it is actively contacting affected users.
All confirmed cases identified so far involve wallets sold through CryptoBilis, a reseller operating in Indonesia, Malaysia, and the Philippines. CryptoBilis has suspended sales of all hardware wallet inventory while the investigation continues.
Key numbers
- Ledger confirmed the unauthorized implant in at least one affected device as of Oct. 10, 2026.
- Third-party on-chain researchers estimate that $86 million to $93 million was stolen from more than 300 wallets.
- The stolen funds spanned multiple blockchains, including Bitcoin, Ethereum, and Tron.
- Ledger has not confirmed an official total loss figure.
- The incident first surfaced on Oct. 9, 2026.
What Ledger's statements say
In its Oct. 10 statement, Ledger confirmed the unauthorized hardware implant in one impacted user's device and said it is contacting affected users as part of an ongoing investigation. In a follow-up update on Oct. 11, Ledger said the volume of impacted devices appears limited. The company stated that all confirmed cases related to the Oct. 9 draining incident involve devices sold through CryptoBilis, and that its internal systems and direct sales channels remain unaffected.
What is confirmed
- Ledger confirmed an unauthorized hardware implant in at least one device linked to the Oct. 9 incident.
- All confirmed cases involve devices sold by CryptoBilis.
- CryptoBilis has suspended sales of hardware wallet inventory.
- Ledger's internal security infrastructure and direct sales channels were not compromised.
- Ledger is cooperating with relevant authorities.
What is still unclear
- Ledger has not released an official total loss figure; the $86 million to $93 million range comes from third-party on-chain researchers.
- The total number of impacted devices is not yet confirmed.
- Ledger has not explained how or when the implant was introduced.
- It is not yet clear how many other resellers or distribution channels may have been involved.
What Ledger is advising affected users to do
Ledger has told CryptoBilis customers not to initialize any unused devices they received from the reseller. For users with active wallets, Ledger advised moving their funds to a new seed on a device obtained directly from Ledger. The company also reminded its network of distributors to source products exclusively from authorized channels.
Why this matters
Hardware wallets are considered one of the safer ways to store cryptocurrency because they keep private keys offline. A physical implant inside a hardware wallet could allow someone to intercept signing operations and steal funds without the user's knowledge. Ledger noted that the confirmation of the physical implant marks the first concrete evidence supporting earlier speculation about supply-chain tampering.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.