PARIS / RankWire.AI / – Ledger has confirmed that investigators found an unauthorized hardware implant inside a device linked to recent cryptocurrency thefts. The case involves wallets sold through Southeast Asian reseller CryptoBilis. Ledger said every confirmed case from the October 9 incident traces back to devices purchased through that reseller. The company has found no evidence that attackers breached its internal systems or direct sales operation. The investigation remains focused on devices that passed through the reseller supply chain.
Ledger began examining the cases after customers reported missing cryptocurrency from wallets bought through CryptoBilis. The reseller operated in Indonesia, Malaysia and the Philippines. Ledger asked CryptoBilis to stop sales and shipments while investigators examined the affected hardware. Customers who bought devices within the previous 90 days received specific security guidance. Ledger advised owners not to initialize unused devices from the reseller. It also told existing users to transfer funds using a newly generated recovery phrase.
On October 10, Ledger disclosed that investigators had identified an unauthorized implant inside one affected customer’s device. The company has not detailed the implant’s design or confirmed its exact purpose. It has also not determined publicly when or where someone modified the hardware. Ledger said it continues to contact affected customers and cooperate with relevant authorities. The company has not established that the same modification appeared in every device connected to the reported losses.
Investigation focuses on reseller supply chain
Ledger said its review had identified only a limited number of affected devices. CryptoBilis suspended hardware wallet sales while the investigation continued. Ledger also reminded its authorized reseller network that returned devices should never re-enter inventory for resale. The company said its own infrastructure and official direct-sales channels remained unaffected by the incident. Those findings have kept the investigation centered on devices distributed through CryptoBilis rather than Ledger’s production systems or online services.
Ledger has not released an official total for funds lost in the incident. Blockchain analytics company Bitquery estimated on October 12 that about $102 million had left 324 wallets across six networks. Its analysis covered Bitcoin, Ethereum, TRON, Solana, BNB Chain and Polygon. Ledger has not verified that total or confirmed that every wallet identified by Bitquery used tampered hardware. The company has also not published a final count of customers whose devices contained unauthorized components.
Blockchain tracing tracks losses across networks
Bitquery’s analysis found that TRON wallets holding USDT accounted for the largest share of the estimated losses. Bitcoin represented the next-largest portion of the tracked value. Bitquery also reported that Tether froze about $10 million in USDT held across 20 wallets connected to the traced transfers. The analysis recorded additional movements through Ethereum and several other networks. Bitquery excluded transfers between wallets that it associated with the same operator from its victim-loss calculation.
Ledger continues to warn CryptoBilis customers against using affected or unverified devices during the investigation. Owners of devices that have never been initialized should leave them unused, according to the company. Customers who already completed setup should move their assets to a different signer with a fresh recovery phrase. Ledger has also repeated that legitimate support staff will never request a customer’s 24-word recovery phrase. The company said its investigation and outreach to impacted users remain ongoing.