Cryptocurrency hardware wallet maker Ledger has confirmed that at least one of its devices, sold through a third-party reseller in Southeast Asia, contained an unauthorized hardware implant, turning what began as scattered customer complaints about drained wallets into a confirmed physical supply chain attack.

In a statement posted October 10, Ledger Support wrote plainly: “Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant.” The reseller at the center of the investigation, CryptoBilis, which serves customers across Indonesia, Malaysia, and the Philippines, has stopped selling all hardware wallets while the probe continues. Ledger said it is directly contacting affected customers and working with law enforcement.

A Fast-Moving Investigation

The case began when customers who purchased devices through CryptoBilis started reporting cryptocurrency vanishing from wallets they believed were secure. In a follow-up update posted October 11, Ledger said every confirmed case tied to an October 9 wallet-draining incident traced back to devices sold through that same reseller. The company characterized the number of affected devices as limited and emphasized that its own direct sales channels and internal systems were not implicated.

Blockchain investigator Specter, tracking the wallet addresses associated with the thefts, estimated potential losses topping $86 million spread across Bitcoin, Ethereum, and Tron. Ledger has not independently verified that figure or published a final loss total of its own, so it should be treated as an outside estimate rather than a confirmed company number.

How a Physical Implant Defeats a Device Built to Be Offline

Hardware wallets exist specifically to keep private keys away from internet-connected computers, the theory being that malware on a laptop can’t steal what never touches that laptop. A hardware implant sidesteps that protection entirely by attacking the device itself rather than anything running on it.

Independent security researcher Mark Karpelès described the suspected implant design as a small added circuit board capable of reading what’s displayed on the wallet’s screen and transmitting that information over a cellular connection, reportedly built from a microcontroller, an antenna, an LTE chip, and an eSIM. Those details come from researcher analysis rather than an official teardown published by Ledger, so the exact mechanism isn’t yet confirmed beyond the company’s acknowledgment that an implant existed. What such a design would target, if accurate, is the wallet’s recovery phrase, the roughly 24-word sequence generated during setup that can restore full control of a wallet’s funds on any device.

That distinction matters because of what it implies about attacker patience: capturing a recovery phrase during initial setup means an attacker doesn’t need to maintain any ongoing access to the compromised device at all. They can simply wait, then drain the wallet whenever they choose, using the recovery phrase on hardware of their own.

Not an Entirely New Playbook

Attackers have targeted Ledger recovery phrases through software before this. Fake Ledger applications have previously been used to target macOS users, and phishing campaigns tracked under the name PoisonSeed have used fraudulent wallet “upgrade” pages to trick victims into typing in their recovery phrases directly. The CryptoBilis case escalates that same end goal, stealing the recovery phrase, into the physical supply chain, raising the stakes considerably since it requires no victim error beyond buying hardware from an unauthorized source.

Separately, a social media user going by Johannes claimed to have purchased a modified device from an authorized European reseller, though that device reportedly had not lost any funds. Ledger has not confirmed this claim, and it should not be read as evidence that tampering extends beyond the CryptoBilis devices the company has already acknowledged.

What Affected Customers Should Do

Ledger’s guidance for anyone who purchased a device through CryptoBilis is direct and urgent:

• Do not initialize or set up any unused device purchased through CryptoBilis
• If a device has already been set up, move all assets to a new device purchased directly from Ledger or another authorized channel
• Generate a brand-new recovery phrase on the replacement device rather than reusing the old one, since the original phrase should be considered compromised
• Report suspected theft to both Ledger Support and local law enforcement

Ledger also warned that scammers are likely to exploit public awareness of this incident to run follow-up scams, and reiterated that the company will never call customers, send direct messages, or ask for a 24-word recovery phrase under any circumstance. The company says it is now reviewing its reseller vetting process and hardware anti-tampering protections, though it has not publicly identified who installed the implant or how many devices were ultimately affected.