Cryptocurrency hardware wallet manufacturer Ledger has confirmed that an unauthorized hardware implant was discovered inside a customer’s device, escalating an investigation into suspected cryptocurrency thefts involving wallets distributed through Southeast Asian reseller CryptoBilis.
The company confirmed the discovery on October 10, 2026, after opening an investigation into reports of missing customer funds the previous day. Ledger said its investigation had found no indication that its internal security infrastructure, systems or services were compromised.
The incident instead points toward possible physical tampering within the distribution chain, although investigators have not established the full scope of the attack. Independent blockchain investigator Specter estimated that losses could exceed $86 million across Bitcoin, Ethereum and Tron.
Separate blockchain analyses have placed suspected losses closer to $93 million, but Ledger has not independently confirmed either estimate or established how many customers were affected. The company is contacting potentially affected users and cooperating with authorities.
Unauthorized Component Raises Supply-Chain Concerns
Ledger’s investigation initially focused on devices purchased through CryptoBilis, a reseller listed as authorized in Indonesia, Malaysia and the Philippines. After examining a device belonging to an affected customer, Ledger confirmed the presence of an unauthorized hardware implant.
The finding establishes that at least one device was physically modified, but does not prove that every reported theft resulted from the same mechanism.
Reports describing the suspected attack suggest that additional circuitry could have been installed to capture sensitive information during wallet initialization. Hardware wallets normally protect private keys within dedicated secure components, reducing exposure to malware running on connected computers.
However, a malicious component introduced before a customer receives the device could potentially compromise information displayed or entered during setup. That creates a different threat from conventional remote hacking.
Ledger has not publicly established where the implant was installed, who was responsible or whether additional devices contain similar modifications. The company also has not confirmed that products purchased directly from Ledger were affected.
Reseller Suspends Sales as Investigation Continues
Following the initial reports, Ledger requested that CryptoBilis suspend sales and shipments of its devices. The reseller subsequently halted sales of all hardware-wallet inventory pending the investigation’s outcome. Ledger advised customers who purchased devices through CryptoBilis not to initialize wallets that have not yet been set up.
Customers who already initialized affected devices were advised to consider transferring their assets to a new hardware signer using a newly generated recovery phrase.
Simply resetting a potentially modified device would not necessarily address the risk of unauthorized physical circuitry remaining inside it. The company also requested information from security researchers through its vulnerability-reporting program.
The incident highlights a limitation of hardware-wallet security: strong cryptographic protections cannot independently guarantee that a device has remained physically unaltered throughout manufacturing, shipping and distribution.
A legitimate device’s security checks may verify its cryptographic components without necessarily identifying every unauthorized addition to its circuitry. For customers, that makes the provenance and physical integrity of hardware devices important alongside software security. The reported losses are substantial, but their exact value and relationship to the confirmed implant remain unresolved.
Ledger’s statement that its systems were not breached also does not mean every affected customer’s funds were secure. The two findings concern different security boundaries: the company’s central infrastructure and the physical devices reaching end users.
The confirmed facts are limited to an unauthorized implant in at least one device, reported customer losses and an ongoing investigation centered on CryptoBilis.
Further forensic analysis will be necessary to establish whether the tampering explains the broader thefts and how the affected devices entered circulation.