Ledger confirmed that an affected user’s device contained an unauthorized hardware implant in an X post on October 10. The discovery shifts the investigation into fund losses linked to reseller CryptoBilis from suspected supply-chain tampering to tangible evidence that a device was physically modified.
This marks the latest development following reports from Ledger users who lost funds after purchasing devices through CryptoBilis. However, the new confirmation is not yet enough to conclude that all reported losses stemmed from the same attack vector.
A Modified Device Does Not Explain All Losses
In its statement, Ledger said it is contacting affected users, working with law enforcement, and collaborating with the security group SEAL 911. The company asserted that there is no evidence that Ledger’s security infrastructure, systems, or services were compromised. This represents the company’s current assessment amid the ongoing investigation, not a comprehensive forensic conclusion for the entire incident.
According to FinanceFeeds on October 11, Ledger has not disclosed the function of the implanted hardware, the device model involved, or when the tampering occurred. The company also has not confirmed whether all wallets reporting lost funds involved devices with a similar modification.
Blockchain investigator Specter estimated that suspected losses across Bitcoin, Ethereum, and Tron could exceed $86 million. Ledger has not verified this figure or the total number of affected customers. As such, evidence from a single modified device should not be conflated with on-chain fund flow estimates to assert that the root cause of all losses has been determined.
CryptoBilis Halts All Hardware Wallet Sales Amid Investigation
Ledger stated that CryptoBilis has suspended sales of its entire hardware wallet inventory as a precautionary measure pending the outcome of the investigation. Both parties are discussing next steps. According to FinanceFeeds, CryptoBilis operates in Indonesia, Malaysia, and the Philippines, and was previously listed as an authorized Ledger reseller.
This detail distinguishes the incident from typical warnings regarding devices bought from unverified third-party sellers. Inclusion in an authorized distribution network does not automatically guarantee that every device maintained its secure state from manufacturing until the customer initialized the wallet.
Ledger’s recommendations directly target buyers who purchased through CryptoBilis: those who have not set up their device should not proceed; those who already configured one should consider moving funds to a fresh Ledger device using a new recovery phrase. The company also reiterated that Ledger will never ask users for their 24-word recovery phrase.
As FinanceFeeds noted, transferring funds to another account generated from the same compromised recovery phrase does not mitigate the risk. The vulnerability lies in the control of the private key, not simply the address holding the funds.
Investigation Needs to Clarify Where Tampering Occurred
Hardware wallets are designed to isolate private keys from internet-connected computers. However, that security model still relies on a baseline assumption: the device received by the user must be trustworthy before generating keys and signing transactions.
With this new discovery, supply-chain questions have become more concrete. Who had physical access to the devices, which batches need inspection, and what did the implanted hardware actually do? Only when these details are disclosed can users separate the confirmed scope of impact from circulating speculation.