Ledger confirms hardware implant on wallets sold by reseller CryptoBilis

Wallets drained without any mistake by their owners

The first warning came from the victims. In early October, users of Ledger hardware wallets reported on social media that transactions had been made from their devices without their knowledge. None of them describe an exposed recovery phrase, and none say they connected the device to a dubious service. One of them lost nearly 100,000 USDT stored on a Ledger Stax. He says: “My recovery phrase was handwritten and kept in a safe place.” According to him, the device was only ever used to receive and hold funds.

In mid-September, other suspicious hardware implants had already been reported on Ledger wallets bought from retailers, as Next points out (in French). The two cases now appear to be linked.

What Ledger confirmed, day by day

The French company first published a security alert on Friday 9 October. The next day, Saturday 10 October, it acknowledged that at least one of its wallets, sold by CryptoBilis, contained a hardware implant that may have contributed to the theft of the cryptocurrency stored on the device. Ledger has opened an investigation. According to the company, CryptoBilis has suspended sales of all its hardware wallets until the investigation is complete, and now shows a warning on its website.

On Sunday evening, Ledger said it was working with the relevant authorities. It stated that the number of affected devices was limited and that it was contacting the users concerned. By the morning of Monday 12 October, CryptoBilis no longer appeared on the list of authorised resellers. The founders of the Malaysian reseller say they sold the company in March 2026 and no longer have any operational responsibility for it or any access to its data.

Ledger has not published how the implant works. The public information describes a supply chain compromise: the device was modified somewhere between manufacture and delivery to the buyer. This happened inside a distribution channel the buyer had reason to trust, since the manufacturer had approved it. A well-protected recovery phrase does not protect you in this situation, because the device itself has been tampered with.

The scale is estimated, not established

No official figures have been released. Independent analysts have tried to measure the extent of the thefts from victims’ accounts and from the addresses the funds were moved to. The pseudonymous account Specter puts the total at $86 million, taken from several hundred wallets. The blockchain analytics platform Bitquery gives a figure of $93.2 million, stolen from 315 wallets. Neither estimate comes from Ledger, and both should be treated with caution.

A user based in Europe also says they found an implant in a wallet bought from Mediamarkt. For now, this case rests on that single account and has not been confirmed by Ledger.

If your device came from this reseller

Ledger’s guidance is aimed first at CryptoBilis customers. If you bought your wallet from this reseller, do not set up a new wallet on that device. If it already holds funds, move them to a different device with a new recovery phrase. Treat the old phrase as compromised.

For everyone else, Ledger advises never buying from an unauthorised reseller, because the risk of receiving a counterfeit or modified device is high. Check the list of authorised resellers again as well. As this case shows, the list can change, and a reseller that was on it when you made your purchase may have been removed since.

A hardware wallet is designed to protect your keys. That protection only holds if nobody has modified the device between the factory and the moment you open the box.